2026

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows A

Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackB

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resou

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges an

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM St

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchroni

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that all

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to ar

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to dow

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash th

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows user

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arb

Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a netw

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limite

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2,

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlle

NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could c

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.

WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. Fro

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desk

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deleti

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index pred

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-t

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Ap

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache To

Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in th

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG i

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpol

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthe

Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionalit

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affec

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before in

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An atta

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle w

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. Thi

Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation

The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that

Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest ch