2026

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection()

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micr

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of use

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered us

Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. Da

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whethe

Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable lo

A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynre

A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_inde

A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file b

A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and acce

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 a

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions bef

A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository).

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-sec

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a w

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of

A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the f

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegrap

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compos

A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_proc

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs E

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Obje

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privile

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter i

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to S

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown

A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of th

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of t

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of

Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its component

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log lev

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 thro

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its sho

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensit

A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /c

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/comp

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Af

A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown funct