2026

An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables u

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to e

A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle att

Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attack

A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally a

An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (

Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and per

An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensi

A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its A

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was

Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-h

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any

vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using fi

An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with n

An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Rou

Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applica

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applica

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that

A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authentic

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulne

The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response in

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could e

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed ce

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recu

In the Linux kernel, the following vulnerability has been resolved: net-shapers: don't free reply skb after genlmsg_rep

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: sps30_i2c: fix buffer size in sps30_

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists w

When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Applia

An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects th

When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic ca

When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual s

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a sh

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configu

When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Manageme

A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Ad

On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in mem

When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIF

A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the

An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through

When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processin

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technolog