2026

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for Add

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmwar

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virt

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C bl

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[] t

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smack_file_send_sigiotask()

In the Linux kernel, the following vulnerability has been resolved: timekeeping: Check the return value of tk_get_aux_t

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notificat

A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0

Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app f

Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: bef

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concret

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic f

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEdito

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, custom

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, custom

A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores sta

An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia I

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camer

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon i

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6

An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacke

Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.

Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 vers

Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.

Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.

Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.

Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.

Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.

Editor SQL Injection in Amelia <= 2.4.9 versions.

Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.

Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions.

Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.

Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions.

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affect

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/autho