2026

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Co

With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a diffe

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VER

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handl

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, w

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with othe

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpre

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusin

MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member

A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an un

A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated at

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix co

A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-

A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the fil

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gy

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/cor

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create ro

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views ret

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing a

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allo

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedC

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated P

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME.

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to saniti

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin

PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creat

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The r

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's f

A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file inde

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vul

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown fun

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted fo

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from b

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmF

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dm

A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functional

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an