2026

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticate

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined pale

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCre

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report conf

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configurat

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configurati

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuratio

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configurati

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that all

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy conf

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration tha

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unaut

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirem

Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s valid

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive Id

Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the c

NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to

Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing cont

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in int

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a diffe

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden t

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets t

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled n

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RE

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPuri

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its datab

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG p

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on un

In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible

In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XM

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing au

Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in th

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, a

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField()