2026

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This i

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown funct

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown f

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHea

Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requ

Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apa

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored c

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearc

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to th

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, an

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method tha

Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image

A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts

A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of t

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/mo

A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in

A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUF

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of

Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring modu

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query strin

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept or

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organiza

ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpo

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace befor

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated u

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any b

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-sup

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sani

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetc

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that a

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer()

@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to sh

@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoof

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrat

hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role p

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, a

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that all

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OID

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EH