2026

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block th

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block th

Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specia

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenti

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious br

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a ma

TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote pee

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.2

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal as

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecke

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabl

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and serv

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to v

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded f

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, a

IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypass

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapte

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapt

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce co

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and befor

A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype N

Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unaut

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be a

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final,

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior t

Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the toke

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Fina

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. These versions use the built

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argumen

The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifyin

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be