2026

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitr

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass syst

Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised t

UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to sp

Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker wh

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise

Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leve

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging s

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outs

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a me

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows una

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDo

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration e

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplie

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated a

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streami

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's region

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without es

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap con

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fix

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was

Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows,

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-y

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and stand

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, p

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.promp

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code e

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js app

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenti

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-contro

A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bul

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handle

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody()