2026

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions

Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and

A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to jo

An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or

An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitra

An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector

Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in the SMB/CIFS. An unauthenticated attacker with r

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or pro

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape use

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugin

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of th

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions.

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.

Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.

Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.

Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.

Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions.

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknow

Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of thes

Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another securit

Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corrupt

Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed eviden

Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox

Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.

Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thun

Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR

Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154

Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14,

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ES

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firef