2026

A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically craft

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically cra

Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter proces

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a mali

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly co

External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App:

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessi

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database an

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that al

ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (S

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated princ

ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP hand

ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTI

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP serv

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransac

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticat

ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforce

ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerabil

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hoo

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce t

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuth

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/sr

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contai

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through t

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers wit

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quote

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, secti

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exac

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints tha

SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/u

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (incl

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to esca

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade I

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer I

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the f

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and me