2026

TypeBot is a chatbot builder tool. In versions 3.15.2, the getLinkedTypebots API endpoint returns full bot definitions t

TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/works

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthoriz

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.16. This vulnerability affects the functio

A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function o

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil element

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. I

Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL

In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for U

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a

Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Fo

Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team S

Missing Authorization vulnerability in SePay team SePay Gateway allows Retrieve Embedded Sensitive Data. This issue aff

Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommer

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activ

A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mas

libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly up

Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Ku

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the applicati

e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on c

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset p

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In

FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attrib

NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks. A s

NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any networ

The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Inst

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not valida

A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0. This affects an unknown

Tanium addressed a denial of service vulnerability in Tanium Server.

The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missin

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to imp

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups func

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData f

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings f

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings fu

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags funct

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags functi

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due t

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuratio

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to i