2026

Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network.

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.4

An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_m

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass t

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensi

Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to

Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensiti

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same ori

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attac

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify deriv

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, m

Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter ins

Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::g

Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Ser

An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechan

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members

Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in

DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availabilit

When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with per

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow acc

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist wh

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provide

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use r

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js use

The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generi

The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or non

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' param

The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, an

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Sto

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verifica

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet c

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handl

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in t

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An aut

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation at

WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/Aut

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and abov