2026

Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Securi

A flaw has been found in OpenSC up to 0.26.1. This affects the function test_kpgen_certwrite of the file src/tools/pkcs1

A vulnerability was determined in indrasishbanerjee aem-mcp-server up to b5f833aef9b5dfd17a5991b3b18a8a11edbdc583. This

A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The imp

A flaw has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The affected ele

A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticat

Lightweight Music Server (LMS) though 3.76.0 contains a stored cross-site scripting vulnerability that allows attackers

A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQ

A vulnerability was identified in itsourcecode Content Management System 1.0. Affected by this issue is some unknown fun

A segmentation violation in the gf_media_get_color_info function (/media_tools/isom_tools.c) of GPAC Project/MP4Box befo

A heap use-after-free in the dasher_process function (/filters/dasher.c) of GPAC Project/MP4Box before 26.02.0 allows at

A segmentation violation in the gf_isom_apple_set_tag_ex function (/isomedia/isom_write.c) of GPAC Project/MP4Box before

A NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function (/media_tools/av_parsers.c) of GPAC Pro

A NULL pointer dereference in the gf_odf_ac4_cfg_dsi_v1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.0

A heap buffer overflow in the m2tsdmx_send_packet function (filters/dmx_m2ts.c) of GPAC MP4Box v2.4 allows attackers to

Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup

Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A m

Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a

A weakness has been identified in itsourcecode Content Management System 1.0. Impacted is an unknown function of the fil

A security flaw has been discovered in itsourcecode Content Management System 1.0. This issue affects some unknown proce

A vulnerability was identified in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the fil

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.

The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the

A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the f

A vulnerability was discovered on Stormshield Network Security  * 4.3.0 to 4.3.41,  * 4.8.0 to 4.8.15,  *

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache Acti

Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections wi

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked lo

The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly b

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections t

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` /

A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names l

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, A

Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Ai

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization

A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable b

A weakness has been identified in itsourcecode Content Management System 1.0. This impacts an unknown function of the fi

A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1. This affects the function

A vulnerability was identified in JeecgBoot up to 3.9.2. The impacted element is an unknown function of the file /airag/

A vulnerability was determined in JeecgBoot up to 3.9.2. The affected element is the function WordUtil.addImage of the f

A vulnerability was found in SourceCodester Water Billing Management System 1.0. Impacted is an unknown function of the

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/A

A flaw has been found in CodeAstro Ingredients Stock Management System 1.0. This vulnerability affects unknown code of t

A weakness has been identified in Assimp up to 6.0.4. Affected by this vulnerability is the function aiNode::~aiNode of

A security flaw has been discovered in Assimp up to 6.0.4. Affected is the function HL1MDLLoader::extract_anim_value of

A vulnerability was identified in Assimp up to 6.0.4. This impacts the function Assimp::MDL::HalfLife::HL1MDLLoader::rea

A vulnerability was determined in Assimp up to 6.0.4. This affects the function HL1MDLLoader::read_meshes of the file HL