2026

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are c

The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value bein

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffm

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob

Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows

Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. This vulnerability allows physically present attac

Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physica

Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows phys

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically pres

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affec

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unkn

Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template inf

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown

A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the compone

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /view

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3,

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows a

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts

A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control S

HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes

HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability a

HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can

HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to acces

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent r

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS)

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. Wh

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text oper

n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authent

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-t

Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.

Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.

Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.

Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.

Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability,

Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any addres

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to ax

A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer derefere

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversize

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-head

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges