2026

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allo

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serializatio

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of t

A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose informat

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a netwo

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthori

Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a netwo

Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges ov

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ para

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to I

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode di

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB al

Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a netw

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges o

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a ne

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attac

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elev

Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network.

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network

Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API,

A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Coll

Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a re

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tR

Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php

Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-suppl

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource arra

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/cont

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates t

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description,

CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.ph

CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed col

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/Syste

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior