2026

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.

Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict serv

On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI)

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI)

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged i

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affect

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/r

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the spl

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire pro

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. St

A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated a

Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing at

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated call

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint tha

IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, a

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows d

A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_repo

A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is

A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown f

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the sta

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions

An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary

SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invokin

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigContro

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission def

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysU

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element i

A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affect

A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability aff

A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/uti

A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality o

n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of co

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint bel

Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privile

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unau

SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go a

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked w

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload quest

Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output en

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 a