2026

BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (tru

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and se

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (tru

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoi

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 1

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 1

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) atta

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML cod

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authent

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authent

IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1

IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 L

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to i

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to i

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptograph

IBM Verify Identity Access is vulnerable to a buffer overflow attack.

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party service

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of

IBM Verify Identity Access containers may not apply management password change operations correctly.

IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mech

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1

An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attacke

A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality o

A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the fil

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvp

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS

BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows

In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not vali

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] withou

Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-im

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar arch

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. v

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts it

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payloa

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program w

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for em

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for em