2026

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCa

Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval an

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the sa

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). T

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMap

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKe

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814c

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue

A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is v

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows A

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an Improper Neutralization of

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insec

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. Thi

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title len

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, all

PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK action

PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when pro

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received fro

PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transac

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by n

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Atta

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInp

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Man

A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cg

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allow

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processi

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown func

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the f

A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhc

A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpack

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unkno

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdate

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-

A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to l

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Ext