2026

Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing da

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH),

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCoo

graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation

monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoi

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in

SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architectu

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the Se

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to f

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate t

Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Ve

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the ema

NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV)

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggera

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Ser

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and u

This vulnerability exists in Quantum Networks router due to improper access control and insecure default configuration i

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firef

Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Fire

Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150.

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderb

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ES

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ES

Denial-of-service due to integer overflow in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 150

Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 15

Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 15

Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption a

RansomLook is a tool to monitor Ransomware groups and markets and extract their victims. Prior to 1.9.0, the API in the

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing fu

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vu

Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the r

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends man

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network version 5.0.1, when dese

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servic

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supp