2026

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was fo

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `wei

ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-con

Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell end

gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts T

Squidex is an open source headless content management system and content management hub. Versions of the application up

Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may a

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnaly

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-S

pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is pre

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve sta

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Mid

A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain co

Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue a

In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restri

Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x8

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 a

Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in htt

Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handlin

The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.

Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arb

Motorola Device Manager 2.5.4 contains an unquoted service path vulnerability in the MotoHelperService.exe service that

Motorola Device Manager 2.4.5 contains an unquoted service path vulnerability in the PST Service that allows local users

SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability in its Windows service configuration that allow

Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service config

Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registratio

Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable th

Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration th

EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potent

Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentiall

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthentic

Insecure file operations in HPE Aruba Networking Fabric Composer’s backup functionality could allow authenticated atta

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, Suricata can crash

By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core syste

The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively lon

The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessi

NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulner

User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overf

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 hav

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause S

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suri

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 hav

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application