2026

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access i

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without prope

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_v

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject cod

A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing th

A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Deni

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint tha

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allow

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file ext

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API

The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-cr

MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event mode

MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The Cont

MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP

A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Locat

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of th

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server tha

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentia

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into me

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and ex

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a comput

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's la

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-pref

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A n

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstra

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated cal

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents

In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe AP

Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (E

MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container t

Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown fun

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /ro

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment not

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before renderi

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side w

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to