2026

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepte

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any r

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker t

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the applicati

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthent

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBeare

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token()

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key()

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() c

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmit

The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote

Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unau

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when config

Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a networ

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an auth

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unautho

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScr

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 migh

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privile

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.securit

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names,

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/m

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTol

libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-contr

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstal

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileS

Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a re

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records

Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a co

A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could a

A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to

An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticate

An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to c

A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow a

An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existi

An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitati

A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with hig

An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation

A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent a

An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated ad

An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could