2026

Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to e

Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the rende

Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.

Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, f

Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthent

Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.

An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause

Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from Untrusted Control Sph

Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control S

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but d

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information o

picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to r

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragme

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying t

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable t

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to

Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier all

PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc.

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference the SystemBuffer pointer withou

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a bu

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This v

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthor

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process t

There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may

There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attack

Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attac

Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attacker

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 pa

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MC

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3,

Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST

Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attack

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authori