2026

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabri

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A

Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosur

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code exec

Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authe

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality No

Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Fun

Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation

Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure v

Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Acces

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce

Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute a

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Succ

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with ne

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlfo

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragment

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Pyt

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an

FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-ba

llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of s

llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a

An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcsc

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registr

An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 throu

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user open

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repos

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administra

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to

Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentiall

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user fr

Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co., Ltd. Tenda A18 v.15.13.07.09 allows a remote at

An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.

A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path t

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can caus

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served wit

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticat

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allo

GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against