2026

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based acce

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks perm

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credenti

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticate

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization,

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project arch

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform pri

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restr

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where th

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticat

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, all

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authent

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controll

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/lo

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlplogg

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attr

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to byp

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an

A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific&

A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to

A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an

A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE

A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticate

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remot

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC cou

A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary f

A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Softw

A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote att

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering t

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marte

Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized a

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.P

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering t

A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote att