2026

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that u

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolatio

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the c

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authen

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a tab

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. I

@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Public-only API token restriction is not enforced on team API routes

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private rep

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on pu

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive inform

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap b

A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave

A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file tracer

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malf

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Fu

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management function

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path t

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and eleme

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Disciplin

A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the fi

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the

An improper access control vulnerability exists where an authenticated non-administrative application user could potenti

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another projec

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, rel

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state c

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulne

The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypa

A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp:

A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of th

A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality