2026

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corru

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap

Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login

llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allo

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remo

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem

A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in t

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skip

A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit

A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev

On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-fac

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastor

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations w

A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer unini

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can

Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant tha

Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can r

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vM

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users

Claude Code validated that a target file path resided within the project working directory at permission-check time, but

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows un

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell comman

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious reposi

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permiss

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name

Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with admini

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application inc

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post titl

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated at

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Medi

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassi

Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read proces

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software So

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynami

Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured A

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket La

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded S

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Sli

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element P

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element P