2026

In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qusb2: Fix NULL pointer dereference on ea

n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe

In the Linux kernel, the following vulnerability has been resolved: udp: call skb_orphan() before skb_attempt_defer_fre

In the Linux kernel, the following vulnerability has been resolved: libceph: make calc_target() set t->paused, not just

In the Linux kernel, the following vulnerability has been resolved: virtio_net: fix device mismatch in devm_kzalloc/dev

In the Linux kernel, the following vulnerability has been resolved: net/ena: fix missing lock when update devlink param

In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: Fix crash when freeing invalid crypt

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL pointer dereference in do_abort_log

In the Linux kernel, the following vulnerability has been resolved: idpf: fix aux device unplugging when rdma is not su

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: fix typo in frequency notific

A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secr

In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controlle

A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X r

When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with con

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error mes

A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) s

A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password

An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software

The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26

Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Ap

On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptob

This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file

Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential informatio

Stored Cross-Site Scripting (XSS) vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not p

The SIBS woocommerce payment gateway plugin for WordPress is vulnerable to time-based SQL Injection via the ‘referencedI

The All push notification for WP plugin for WordPress is vulnerable to time-based SQL Injection via the 'delete_id' para

The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' para

The Smart Appointment & Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saab_save_form

The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin se

The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in

The WebPurify Profanity Filter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing

The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions

The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a mis

The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via t

The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in

The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa

The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API

The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization i

The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, a

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Karel Elect

If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such m

A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitr

Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an atta

Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an atta

Improper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute pri

Path traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Sam