2026

A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Sof

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Lin

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Lin

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privi

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fiel

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using th

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human language

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags su

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appl

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to exec

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform comman

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perfor

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE

A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardint

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/r

A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-reposito

A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown fun

Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled tele

Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerabi

Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthentica

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privileg

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial a

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior

Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthent

FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege att

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that f

MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update

DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that a

Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns sched

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and i

A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserControl

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file core

A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search

@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records o

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backst

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, Re

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints b