2026

A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attacker

An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in

Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple stack overflows in the formSet

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side F

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines

When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index st

This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-ran

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfe

An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSO

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending r

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on t

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have t

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0

A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user a

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a r

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debus

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages

A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows Fil

Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Dat

Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and S

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated

Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.

Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd pr

An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allo

Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.10.8, 18.11 before 18.11.5, a

IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by th

aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup ch

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad.

A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buf

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows a

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allo

Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass

Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compr

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validatio

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can e

Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticate

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate res