2026

Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who c

Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unaut

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticat

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress i

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticat

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validati

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, aff

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild ou

A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a

A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Back

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 2

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-b

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptio

A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the fi

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_up

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowin

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long r

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8,

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8,

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8,

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticat

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any a

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authentic

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-3340

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handl

A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of t

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown cod

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown function

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWrite

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Contro

Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-co

A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerab

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.

Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin s

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractIte

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount co

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL up

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers