2026

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelis

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framewo

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:re

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template help

Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{i

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/

Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventList

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\Child

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as Date

pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python

HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper a

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engi

A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, wher

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them

Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode()

Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role u

TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints t

TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated atta

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/rout

Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to ca

Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any

Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking i

Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows u

A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environmen

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 aut

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file to

Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). This issue a

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to mana

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of

HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method

HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS)

HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary

HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information

HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to

HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk as

HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying

HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an atta

HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header

HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by th

HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensiti

HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead