2026

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying t

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7

Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects Connex

Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Identit

Out-of-bounds Write, Out-of-bounds Write, Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing Servic

Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragme

picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to r

Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulnerability. A low privileged att

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information o

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but d

PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypas

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of t

Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control S

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all pla

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability. An unauthentic

NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules.

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileg

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerabi

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability. An unauthentic

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from Untrusted Control Sph

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX

A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimsta

Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force S

An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause

Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.

Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.

Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.

Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions.

Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.

Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.

Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) cont

Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Leve

Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.