2026

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context

Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the contex

Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker co

Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability th

A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process insid

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful t

The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTT

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 t

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 t

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in

Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution i

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary fi

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available me

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass acce

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handle

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth:

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow dec

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows user

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limite

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2,

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlle

NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could c

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.

WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. Fro

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desk

Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in th

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthe

Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionalit

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1

Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation

The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that

Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest ch

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To m

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all ver