2026

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within t

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing s

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb

libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before an

libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and includ

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the clien

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.M

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, i

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is cor

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanit

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user perso

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allo

Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Reso

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler`

Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local a

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module

A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System

A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-a

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/

FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_appl

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileg

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processin

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns at

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is

SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows da

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticat

In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this proces

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows g

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certifi

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Danc

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the bu

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a wo

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attri

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outpu

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fe

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle d

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IO