2026

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes t

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an aut

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Ins

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a brok

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspa

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpo

A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecastin

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git s

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The acti

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-contro

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows a

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows un

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specia

Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153,

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Fi

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Fi

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Fi

Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 1

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderb

Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbir

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13,

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefo

Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Th

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFi

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.

The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQ

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values bef

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B