2026

An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a De

A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary us

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbi

money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Althoug

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token sec

Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to versio

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Acc

An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically proximate attacker exe

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4

A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthent

A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privile

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information o

A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote att

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the functi

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary c

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary c

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar us

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user co

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailbo

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated D

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. A

A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Med

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-grap

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a s

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via t

An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file

A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that cou

MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthentic

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never c

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler th

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (p

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the s

A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation s

A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The share

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject i

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allo

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and races when toggling H

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree_sensitive() for derived ke

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero as a random number Z

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shado