2026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimp

Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY w

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platform

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior

Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wi

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB i

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowin

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*']

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticate

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell

restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload wi

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticat

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extensio

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation

Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage ex

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation

A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a reques

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 v

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.

Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.

Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.

Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Con

Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.

Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Fir

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent all

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC au

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to versio

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two a

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the w

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname wa

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/pa

A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f

A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system wri

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the

Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringifi

UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user ma

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user ma