2026

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datado

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts a

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive con

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission gu

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWid

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with

A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functiona

A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function _undone_qty in the library src/WtCo

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference name

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree opera

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attacke

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthent

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the c

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a Do

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a Do

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condi

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condi

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WT

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /socia

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the Data

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissio

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. Th

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when

Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification f

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:cre

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:select

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in th

An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permissi

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass expose

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prio

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the ex

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file

A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied pat

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for p

Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthent

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopT

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlis