2026

ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUN

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repos

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attacker

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypasse

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.res

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options wit

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treat

phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAut

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure count

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP au

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued befo

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by trunc

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled.

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (a

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup.

An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Privilege Management vulnerability. A high pri

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery (SSRF) vulnerability. An una

An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the a

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can brea

Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in serv

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain G

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated requ

Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.

Unauthenticated Local File Inclusion in Resido <= 1.5 versions.

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.

Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.

Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.

Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program h

The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protec

As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing

After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqu

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthentica

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored C

The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for

The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer fo

Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepa