2026

Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 15

Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunde

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firef

Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 15

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ES

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefo

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ES

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Fire

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderb

Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.

A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function

The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-cal

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges cou

Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receiv

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at

Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a cr

Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is n

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combi

Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authentica

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests i

LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render un

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sou

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescrip

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget c

LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable

LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configura

AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attacke

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform s

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeo

Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could p

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all ve

An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Jav

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affec

Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attack

Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_

A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior t

A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromIns

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affec

NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mT

A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administ