2026

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which co

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or c

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 a

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or pote

IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service componen

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 a

IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the admi

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the fil

IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX conne

Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthen

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete

In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project with

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function

In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrar

In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg()  fun

In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token coo

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categorie

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQ

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrar

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level enc

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library ma

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the d

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to valida

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlon

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails t

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attacke

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-s

A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM

A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running p

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process met

Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifyAttestationReportTLS in the AMD

Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applic

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last W

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt()

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuT

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for pro

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Profess

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset