2026

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypa

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote att

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the serve

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDat

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /sys

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-sit

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients wit

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with S

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig

A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread e

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing al

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with t

A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials assoc

Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnera

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certif

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for reci

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that al

A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIP_Com_FileList.asp

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function D

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local a

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind cr

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confin

Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192,

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_fu

Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs pe

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echo

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role adm

The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, th

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that r

HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using

A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen

Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication

Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, requir

Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templa

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/te

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file ad

In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to