2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges loca

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Softwar

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions throu

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling function

Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the S

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation p

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitra

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, f

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Ma

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a ne

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to el

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before vers

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authentic

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges loc

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypas

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the render

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is abl

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrar

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds m

Memory corruption while using alignments for memory allocation.

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this is

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticat

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3,

Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a net

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a networ

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to

Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a secu

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Manag

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sh