2026

GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any

GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administ

GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a val

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redi

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer.

An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.  The host streaming API function {{c

A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10

An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior,

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricki

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The iss

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure commun

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in c

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerabi

Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Armiya Information

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the ke

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during re

The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation ch

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its secon

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a valid

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds th

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displa

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card cou

A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged

A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Ch

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arb

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflect

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary m

A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an un

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypas

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticat

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to

A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enable

An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to

An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excess

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis b

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and as

When the broker is processing message-based management requests, sent by an authenticated messaging client that is autho

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBS

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized br