2026

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK befo

The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process an

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Tr

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue af

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5,

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allo

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that all

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by sup

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows rem

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility tha

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and

The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unau

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path o

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GI

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration t

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticate

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCre

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to

Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s valid

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the c

NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on un

In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing au

Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in th

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, a

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField()

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualiz

Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.

Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 ver

Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.

Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro a

Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit al