2026

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URL

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avati

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Pri

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without

In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentica

In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem pro

In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path co

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organizatio

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to t

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(),

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allo

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrich

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decod

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_

SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregat

NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expres

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versi

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request U

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on perio

NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controll

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can i

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate v

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A succe

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement o

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A su

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentic

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate v

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded pa

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource co

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded cred

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource

NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a

NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious dat

NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause re

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.55.10.0. The

MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org orga

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that a

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list

In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element cap

The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_ins