2026

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK befo

The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process an

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, a

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Tr

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue af

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5,

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allo

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that all

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by sup

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows rem

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters r

The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated att

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility tha

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `inter

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Executio

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and

The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly se

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that a

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unau

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path o

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GI

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user i

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration t

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inf

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthentica

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authentica

APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Pr

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to versi

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to S

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/star

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) th

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validat

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjace

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscrip

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attacker