2026

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions req

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriv

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, Co

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.

An unauthenticated user may bypass authentication under specific cache conditions.

A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

A bundle writer may create misleading release promotion information under specific conditions.

A repository publisher without delete permission may modify protected package content under specific conditions.

An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in

An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific co

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditi

An authenticated user may view private Puppet module metadata without repository read access.

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

An unauthenticated user may access restricted repository information under specific conditions.

Credentials for a deleted user may remain valid for a short period under specific conditions.

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvert

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::se

Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk s

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modu

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_re

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm

Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random pa

Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows S

A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.

A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an

A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.

Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload

Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-pri

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status i

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-si

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succee

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when re

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CS

The hunt_delete() VQL function allows deleting hunts.  Velociraptor misapplied the permission check requiring only COLL

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Sess

Velociraptor allows reading Stacked result sets from the GUI.  Velociraptor's multi-tenant design stores sub orgs within

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerabl

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTM

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one o

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX ac

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the ca

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload int

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allow