2026

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS

Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via

Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.3

Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools. Prior to version 1.7.

Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attack

Boundary-unlimited vulnerability in the application read module. Impact: Successful exploitation of this vulnerability m

Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to by

Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass

Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attacker

The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping"

Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brut

Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a phys

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF toke

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpo

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER deco

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Prior to 7.15.2, an authorization b

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servic

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servic

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0,

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior t

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostna

A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.

A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions

OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries th

A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted ser

OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allow

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign auth

Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with onl

Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modu

Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_m

Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to

Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker c

SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoin

There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated u

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vuln

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vuln

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php comp

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when t

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versio

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP aut