2026

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode

CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs n

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-rese

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submi

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local use

RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths.

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated use

/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_

JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions()

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON tok

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's S

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nes

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompleti

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API a

LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file w

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of he

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authenticati

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the ru

A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an exten

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted imag

A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously

Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabiliti

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivi

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regener

MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security contr

MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator opt

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string li

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to e

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape Op

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The pr

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses v

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an atta

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can i

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, a

A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogi

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the fil

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class canno