2026

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/W

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-eng

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_direc

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dep

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authe

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attack

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticat

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 202

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tenso

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click o

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive inform

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the S

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit functio

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element i

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause imp

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set Fil

Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whethe

A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The AP

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially c

The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer.

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, le

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address s

Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157,

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a r

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharac

A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attack

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityP

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sen

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignm

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasoni

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) t

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same s

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's custo