2026

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Sta

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19

The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses afte

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. Whe

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 exten

CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /c

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the

ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated custome

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume si

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrar

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed

When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running o

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traver

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote att

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote at

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to i

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticate

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote at

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executab

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allow

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module r

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals

In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reasse

In the Linux kernel, the following vulnerability has been resolved: mtd: virt_concat: fix use-after-free in mtd_virt_co

In the Linux kernel, the following vulnerability has been resolved: mtd: virt_concat: fix use-after-free in mtd_virt_co

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix root leak if its reloc root is unexpecte

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on core-sched forced idle in

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound p

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent rereg_mr for non-mem regions W

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_crea

In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARN_ON in add_mtd_device(

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on u

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: clamp virtio RX length before

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helper_firmware_

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: convert pmsr_free_wk to wiphy_work

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range P

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free AP_VLAN bc_buf SKBs outside IR

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner aut

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cl