2026

A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attacke

Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication tok

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Ima

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosur

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosur

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosur

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `x

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows aut

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores

In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to loca

Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain

In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to l

In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing per

Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Contro

A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mod

XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts coul

In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could l

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_

NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size

PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequ

An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious g

Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacke

node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= recor

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve use

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can cr

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can cr

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can cr

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can cr

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vit

NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controll

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that pe

Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an ou

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.3

When using the "configparser" module to write configuration files containing multi-line text values with carriage return

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModules

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK (Rust Token Killer)

Module: plugins/modules/keyring_info.py CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: The module

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-s

Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PA

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: stop OGMv2 on disabled interface Wh

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: disallow unicast fragment in frag

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: stop hash:* range iteration at en

In the Linux kernel, the following vulnerability has been resolved: vrf: Fix a potential NPD when removing a port from

In the Linux kernel, the following vulnerability has been resolved: batman-adv: clear current gateway during teardown

In the Linux kernel, the following vulnerability has been resolved: af_unix: Reject SIOCATMARK on non-stream sockets S