2026

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting partic

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server proces

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to han

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to in

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected t

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to ma

A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_mi

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users fr

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulne

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakne

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secre

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create()

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenti

n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operati

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The

Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the

A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is v

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.

A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affec

A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated sta

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated sta

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete ar

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the se

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTI

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persisten

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace membe

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace mem

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to in

The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver

A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function,

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipu

Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerabilit