2026

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject per

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release B

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an a

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (cu

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload th

Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken fr

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The mas

Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsin

Vulnerability-Lookup contains a server-side request forgery (SSRF) vulnerability in the remote-instance synchronization

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Ac

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to S

A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr'

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions req

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues:

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crat

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriv

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds a

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA a

RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/servi

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, Co

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration acce

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_conte

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.

An unauthenticated user may bypass authentication under specific cache conditions.

A user with access to a valid SAML response may impersonate another user under specific conditions.

A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

A bundle writer may create misleading release promotion information under specific conditions.

A repository publisher without delete permission may modify protected package content under specific conditions.

An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in

A Project Resource Manager may gain broader administrative privileges under specific conditions.

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated att

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8

An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific co

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditi

An authenticated user may view private Puppet module metadata without repository read access.

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

An unauthenticated user may access restricted repository information under specific conditions.

Credentials for a deleted user may remain valid for a short period under specific conditions.

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvert

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::se

Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `

Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the und

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation