2026

A vulnerability has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. The impact

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge th

A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unau

A flaw was found in the rgaufman/live555 fork of live555. A remote attacker could exploit a segmentation fault, in the `

An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-b

An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects t

A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, t

The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode dis

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length li

A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a

An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return pr

A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTem

A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the fu

A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown proc

A weakness has been identified in FascinatedBox lily up to 2.3. This vulnerability affects the function count_transforms

A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the librar

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vul

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulner

A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vuln

A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthash_for_nam

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check

PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient

The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference

PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor

The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version

A vulnerability was determined in Squirrel up to 3.2. Affected by this vulnerability is the function SQFuncState::PopTar

A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unkno

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 1

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SH

In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 1

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SH

In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10

code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management

code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestr

CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that al

Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allo

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter f

A vulnerability has been found in wren-lang wren up to 0.4.0. This impacts the function printError of the file src/vm/wr

When BIG-IP AFM or BIG-IP DDoS is provisioned, undisclosed traffic can cause TMM to terminate.  Note: Software versions

The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parame

Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 all

Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Genera

SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX disp

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid sh