2026

Path traversal for some gaudi-container-runtime before version 1.24.0 within Ring 3: User Applications may allow an esca

Uncontrolled search path for some Approximate Bayesian Inference Framework before version on commit #484c949 within Ring

Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring

Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User

Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Appli

Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applicatio

Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local acce

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mc

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine l

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/

Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal

Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrar

A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to e

A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kern

Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disc

Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Proce

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resum

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_tu

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and cr

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/a

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in A

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in A

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have a

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint t

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreer

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer

In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUG_ON() There's

In the Linux kernel, the following vulnerability has been resolved: serial: 8250_mid: Fix NULL function pointer derefer

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec comm

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fit paired fragment job in the cor

In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mod

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref

In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter

In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_part

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with sr

In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: fix infinite loop in NCQ tag c

In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root in

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker