2026

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/p

Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows

Wildfire IM is an instant messaging and real-time audio/video solution. Prior to 1.4.3, a critical vulnerability exists

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and

IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decry

IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could all

IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expos

IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF

Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs. When OOM

Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after di

A vulnerability in Brocade SANnav before 2.4.0b prints the Password-Based Encryption (PBE) key in plaintext in the syst

A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN clie

A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restora

A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration modu

A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the

A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows adjacent authenticated attack

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) allows adjacent authenticated attack

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows adjacent authenticated attack

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and OpenVPN of AXE75 v1 allows an adjace

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticat

A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Und

Transient DOS when processing a received frame with an excessively large authentication information element.

Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Memory Corruption when multiple threads simultaneously access a memory free API.

Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inad

IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 through 7.1.0 iFix005 is vulnerable to access control violatio

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installati

An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password b

A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration pre

An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration pr

An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration pres

An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration pres

A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.

An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting clie

During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helpe

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP

A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles r

EAP Legislator is vulnerable to Path Traversal in file extraction functionality. Attacker can prepare zipx archive (defa

A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocat

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Tech

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploi