2026

Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensi

Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data v

Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sen

Inappropriate implementation in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obt

Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain poten

Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sen

Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potent

Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potenti

Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and o

Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files b

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows re

Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated atta

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (E

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carrie

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service account

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.

Open STA Manager 2.3 contains a path traversal vulnerability that allows authenticated users to download arbitrary files

A vulnerability was found in Tenda W12 3.0.0.7(4763). This issue affects the function cgiSysWebTimeoutSet of the file /b

An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows a

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/A

A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable b

A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names l

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` /

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked lo

A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The imp

Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Securi

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stor

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mamunur Rashid Classifie

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may

Nextcloud is an open source content collaboration platform. Prior to version 5.2.6, a missing permissions check allowed

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerabil

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, a

Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain a denial-of-service vulnerability that allows remote

In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer

In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow

In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This

In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause the system to crash due to an inte

In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper inp

In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow

In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow

Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerabil

A buffer overflow vulnerability in the UPnP AddPortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.1

A buffer overflow vulnerability in the UPnP DeletePortMapping() command in Zyxel VMG4005-B50B firmware versions through