2026

A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenToke

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query f

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT auth

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extr

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unab

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequa

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.

Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be abl

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store,

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Rea

Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elast

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequ

Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticate

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_reg

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file

A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file co

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the fi

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Bui

An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a pr

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that pro

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authe

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability.

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fall

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc.

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/forms

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel m

EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote atta

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP P

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Pa

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Fre

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpa

A role-based access control issue was identified in the administrative expression evaluation functionality. This could a

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount o

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board crea

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown aut