2026

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5,

Server-Side Request Forgery (SSRF) vulnerability in Brecht Visual Link Preview visual-link-preview allows Server Side Re

A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet For

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyze

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versio

A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PI

Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attack

Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This fail

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the re

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version th

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notifica

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to re

An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead

A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blu

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host a

HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as

Cleartext Storage of Sensitive Information in Memory vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo M

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin d

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditi

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not p

An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge

A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Fire

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Ge

An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Mana

Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following')

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported v

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported v

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported v

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name

A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to e

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a pri

IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection. A privileged user could send

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd perm

OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to exe

OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execut

OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to exe

OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to ex

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mo

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attac

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme S

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI co

Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.

A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management setting

A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Manageme

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version th