2026

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.

The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname valid

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption d

Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information o

Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

Azure Entra ID Elevation of Privilege Vulnerability

Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, inst

Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versi

Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below,

Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to dis

Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose inf

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view s

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unau

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize

An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges

This vulnerability occurs when the system permits multiple simultaneous connections to the backend using the same charg

This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unautho

This vulnerability arises because there are no limitations on the number of authentication attempts a user can make. An

An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to netwo

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary

Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication

Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condit

Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to laun

Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on at

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to cha

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repos

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with rea

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a

Gitea does not properly validate project ownership in organization project operations. A user with project write access

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachmen

An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repos

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sani

A low-privileged user can bypass account credentials without confirming the user's current authentication state, which m

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally con

The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvi

Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.1

Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.1

Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. An unauthenticated attac

A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality o

An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation.

An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery P

Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configur

Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting