2026

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after passwo

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PA

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_pro

Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new t

@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) con

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated use

LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in int

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A m

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was st

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket b

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivi

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions

On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 ac

Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versio

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device mo

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive In

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to s

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTi

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the functio

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeep

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically register

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDec

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force.

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token

Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Bro

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST v

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On all

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folde

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versi

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bl

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested Ser

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, appl

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped au

A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of