2026

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.role

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persisten

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to ex

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event org

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event org

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote

An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace membe

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace mem

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-s

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mani

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-s

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypas

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace t

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability relate

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Soft

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upg

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially craf

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /acco

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to in

The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver

Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feat

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoi

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's

Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can cont

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface usi

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low

`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged

A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function,

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON wit

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token dec

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an at

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmars

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching th

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authenti

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no v