2026

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account c

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific condi

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and ret

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository acc

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written ou

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentia

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administra

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 thr

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped sp

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, trans

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authe

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a r

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged use

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a valida

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the pl

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory alloca

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memor

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authent

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 thr

Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains

A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch

A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access control

In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handl

The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a s

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authen

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authent

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authe

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 thr

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted reque

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 thr

Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authe

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor s

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the termin

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated term

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who i

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery sy

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Comm

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileg

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only per

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-adm

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concaten