2026

Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network

Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a netw

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an

Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally

Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerabi

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerabi

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors t

An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerabi

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerabi

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation an

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealm

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in ag

fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to re

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authent

Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileCo

MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage obje

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables T

Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password t

A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the funct

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/a

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a r

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote u

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2