2026

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Return queued buffers on start_str

PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when u

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Requi

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix for dma-fence safe access rules C

In the Linux kernel, the following vulnerability has been resolved: Revert "arm64: zynqmp: Add an OP-TEE node to the de

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deployin

Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which the

The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated u

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login han

The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includ

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb fra

PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes

The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before

An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /

AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key us

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(

yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting

A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti befor

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi

Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the

Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (devic

NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM

A vulnerability was found in Tenda CX12L 16.03.53.12. This issue affects the function formSetPPTPServer of the file /gof

A vulnerability has been found in Totolink X5000R 9.1.0u.6369_B20230113. This vulnerability affects the function sub_458

Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/

The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local

A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknow

A weakness has been identified in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /lo

A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0. This impacts an unknown function of the f

A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. This affects an unknown function of the file /

A vulnerability was determined in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the r

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive b

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before vers

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive con

PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before vers

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code exec

A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the

A flaw has been found in SourceCodester Comment System 1.0. This issue affects some unknown processing of the file post_

This vulnerability, in the MAXHUB Pivot client application versions prior to v1.36.2, may allow an attacker to obtain e

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to

Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges ove

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This un

Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges