2026

Code execution in AssistFeedbackService of TECNO Pova7 Pro 5G on Android allows local apps to execute arbitrary code as

A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mo

The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.

The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5

A vulnerability has been found in AlejandroArciniegas mcp-data-vis bc597e391f184d2187062fd567599a3cb72adf51/de5a51525a69

The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via

The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an at

A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality o

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys.  The private cryptographic keys l

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM. Opening a crafted V7 fi

V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CSaveData::_conv_AnimationItem. Op

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Openi

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a cra

V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom. Open

A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authentica

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DN

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient re

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a sto

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs we

Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-S

Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.

An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distingu

Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0,

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in app

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to b

Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0,

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containmen

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql

pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow a

A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated,

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with re

Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier all