2026

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffer

**UNSUPPORTED WHEN ASSIGNED**  Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a loca

The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — n

Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the f

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the f

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user sess

Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an at

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Obje

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code executio

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with

Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52 - The Joomla extension

An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint pr

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicem

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security L

@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrenc

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses i

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a le

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent

### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the pe

@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname,

In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in

In the Linux kernel, the following vulnerability has been resolved: f2fs: read COW data with the original inode during

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing read bio submission on large foli

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write fai

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix warning when unbinding If there

In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in store_modes() store_m

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: restrict number of unacked li

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid divide-by-zero for dec_

In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting tim

In the Linux kernel, the following vulnerability has been resolved: ASoC: rsnd: Fix potential out-of-bounds access of c

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak i

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add missing bits in airoha_qdma_cleanu

In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failu

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains whe

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garp_p

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on iso_pi fields in h

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mm_struct reference leak in aie2

In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Preve

In the Linux kernel, the following vulnerability has been resolved: serial: dz: Convert to use a platform device Preve