2026

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firef

The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft W

The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Expos

Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versi

Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper fi

A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability

TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the T

Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, crea

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO

The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability

A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200M

A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains

Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthe

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-up

The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient

The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models.

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a m

Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthen

SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated u

The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographi

Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticat

Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attack

Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to

Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an a

Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authent

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthe

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the fu

SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensiti

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arb

Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access info

Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacke

SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switc

SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module

OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP serv

Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Reque

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapsli