2026

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: AOL Generic Loader

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Da

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Support

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authe

In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the

Memory Corruption when processing registry values with incorrect types using a direct query method.

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for sto

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerabi

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerabil

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transf

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application lo

OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt a

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to el

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessi

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSF

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an a

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 al

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The support

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor

Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injec

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize man

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-pr

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where use

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the d

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerab

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an out-of-bo

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could cr

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could s

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a stack-base

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local authenticated attacker to execute arbitrary code due t