2026

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook featu

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages

In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CON

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to rea

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree opera

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attacke

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a Do

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a Do

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condi

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condi

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /socia

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the Data

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissio

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. Th

An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permissi

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for p

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgr

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a de

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitr

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for th

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not p

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST p

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used t

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does n

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 d

A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in th

A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys

A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C

A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code o

A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Fil

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memor

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause G

A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functional

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a netwo

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized

Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows a