2026

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk siz

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREA

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap F

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_re

In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remo

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse_uring_commit

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to ent_in_us

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse_req on io-uring cancel task wo

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_asyn

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only find

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from ent_w_

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2

In the Linux kernel, the following vulnerability has been resolved: xfs: don't wrap around quota ids in dqiterate LOLL

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options.

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all version

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) rece

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code executio

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches t

A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes tha

A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

Weintek cMT3092X HMI stores user account passwords in plaintext.

An attacker can modify data that should be restricted to read‑only access.

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computa

The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on

NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations m

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc fil

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and A

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decod

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video de

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF d

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allo

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milk

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensyste

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA ba

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that a