2026

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identifie

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported

Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in S

Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and

Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with

Integer overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of bounds access during lo

Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing

Improper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access duri

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. Wh

The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across file

radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to re

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's ta

Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address informati

OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.

Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The

Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compou

Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User App

Buffer overflow for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications

Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Appl

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the admin settings update

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow

SQL Injection affecting the Access Manager role.

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.

Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.

Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.

The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up t

The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing c

Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vulnerability may affec

Authentication bypass by primary weakness vulnerability in ABB Freelance. This issue affects Freelance: through 2013, 2

OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-own

OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path t

A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can

OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Objec

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitutio

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffe

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing alrea

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Lo

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin fo

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM

Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a phys

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affec

Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect ava

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince co