2026

A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for t

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-ser

A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of th

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Asser

A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid no

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 tok

A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. Ne

Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests t

Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypa

An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate r

A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client

A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by ca

A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolu

A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page —

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode

Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An att

Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed thr

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Option

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) serve sensitive administrative content wi

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account l

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resour

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vul

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) pr

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password f

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a secu

There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop appli

Tanium addressed an uncontrolled resource consumption vulnerability in Discover.

Tanium addressed an improper input validation vulnerability in Discover.

Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During ins

A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticate

Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows

Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allow

Forma LMS 2.3 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts int

IDT PC Audio 1.0.6499.0 contains an unquoted service path vulnerability that allows local users to potentially execute a

Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local

PDF Complete 3.5.310.2002 contains an unquoted service path vulnerability in its pdfsvc.exe service configuration. Attac

Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject

Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authentica

Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature

MiniTool ShadowMaker 3.2 contains an unquoted service path vulnerability in the MTAgentService that allows local attacke

Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to

An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-

Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/sha

IObit Uninstaller 10 Pro contains an unquoted service path vulnerability that allows local users to potentially execute

An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLI

A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Releas