2026

Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageabili

Hardware logic contains race conditions for some 3rd Gen Intel(R) Xeon(R) Scalable Processors within Ring 3: unprivilege

Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Dom

Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Softwar

A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could al

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to

Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into t

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to

Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives

Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow a

Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(

Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R)

Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: H

Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a

Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected t

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_re

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runti

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vi

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimbal

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupw

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen va

Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[]

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can reta

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c acce

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace ad

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with a

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker wi

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the develop

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via loca

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code executio

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting partic

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting parti

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltr

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JS

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getShee

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed S

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT perm

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, s

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server proces

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to han

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to in