2026

Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attac

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) all

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthoriz

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthoriz

A security vulnerability has been detected in code-projects Feedback System 1.0. Impacted is an unknown function of the

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In ve

Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orche

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum databa

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT sess

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it recei

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as e

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPyt

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_

GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitP

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFrom

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::san

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with

A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authen

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthen

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authentic

An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticat

An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unaut

An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote

Regex Denial of Service in youtube-regex npm package through version 1.0.5.

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when p

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (de

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column an

NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder all

Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster C

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP

Improperly controlled modification of Dynamically-Determined object attributes, Allocation of resources without limits o

Memory safety bugs present in Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presum

Memory safety bugs present in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. Some of these bugs showed evidence of me

Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2,

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in DivvyDrive Information Te

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Informa

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, a

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched

monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF)