2026

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly co

External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App:

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessi

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database an

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that al

ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (S

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated princ

ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP hand

ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTI

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP serv

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransac

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticat

ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforce

ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerabil

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hoo

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce t

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuth

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/sr

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contai

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through t

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers wit

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quote

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, secti

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exac

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints tha

SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/u

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (incl

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to esca

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade I

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer I

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the f

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and me

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained a

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informat

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via une

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/

SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issu