2026

An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier a

A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x a

An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlie

A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allow

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated at

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attac

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthen

XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any A

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows lim

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allow

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unaut

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allow

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multi

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthor

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthent

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to mis

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient vali

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which estab

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation o

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade

CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgr

CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved main

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software c

CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to res

CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to re

Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service a

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved

Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade t

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user su

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assig

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary pr

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). Q

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_c

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste han

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-n

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] acros

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providin

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a miss