2026

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2,

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::B

CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticate

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) servi

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the mar

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constru

LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escap

Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to upd

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor mercha

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-loc

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Dele

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scri

IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnera

IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inj

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-fo

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force a

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Sto

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local a

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid f

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browse

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across ident

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cli

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in t

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce chec

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a fr

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX han

The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a

The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks befor

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an H

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, all

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX hand