2026

SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks c

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted

SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated atta

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol pars

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, T

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contain

The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single fi

The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input pro

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive co

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to e

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not c

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-be

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-be

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may all

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability t

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmi

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory func

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/wind

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-rec

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_templat

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, p

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayabl

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can retu

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashb

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploi

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the defau

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could al

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in a

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly ag

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how Rol

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Ac

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, whic

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. Th

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security harde

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerab

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to kn

A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the sp