2026

Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an u

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Cu

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on

A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corrupti

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user

WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/Aut

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation at

An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitiv

An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitiv

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed t

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb w

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corrupti

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin acces

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxk

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An aut

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By u

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-ma

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly res

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.1

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.1

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on t

During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/sr

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handli

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in t

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server ac

rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf56d3, the Rust demangler in src/rust/rust_v0.c can

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handl

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGrou

A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrar

A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Manageme

A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management

A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management setting

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet c

Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that a

Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a c

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently

HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The applicat

HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy