2026

SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privi

SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send

SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with l

SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing securit

SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer

SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated att

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation

SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks c

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted

SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated atta

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol pars

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, T

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contain

The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single fi

The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input pro

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive co

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to e

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not c

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-be

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-be

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may all

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability t

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmi

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory func

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/wind

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-rec

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_templat

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, p

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayabl

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can retu

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashb

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploi

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the defau

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could al

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in a

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly ag