2026

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to

Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives

Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow a

Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(

Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R)

Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: H

Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a

Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected t

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_re

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runti

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vi

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimbal

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupw

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen va

Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[]

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can reta

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c acce

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace ad

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with a

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker wi

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the develop

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via loca

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code executio

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting partic

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting parti

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltr

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JS

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getShee

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed S

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT perm

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, s

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server proces

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to han

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to in

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected t

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to ma

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected de

A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code ex

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init ca

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesse