2026

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Fo

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki -

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matc

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authori

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated at

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 oc

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap

RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests,

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing a

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment ha

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages i

pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization tha

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App a

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionali

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough b

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is und

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redi

Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API tha

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function

ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authent

CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide spe

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environmen

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a networ

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the

A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationF

A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webk

X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the d

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobi

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to m

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signa

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source featur

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing r

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an att

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are render

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails