2026

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's app

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /genera

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit pl

A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequate

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments i

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission process

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpA

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundati

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Ex

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Funct

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions.

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.st

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, pro

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticat

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edi

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollb

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerabili

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channe

Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code ex

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthentica

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL po

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more

Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key o

Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summar

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out o

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incomi

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap grow

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header wit