2026

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion

Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic c

Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages

In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CON

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follo

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malici

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to rea

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the Redis

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datado

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts a

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive con

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission gu

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWid

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with

A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functiona

A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function _undone_qty in the library src/WtCo

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference name

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree opera

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attacke

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthent

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the c

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a Do

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a Do

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condi

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condi

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WT

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /socia

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the Data

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissio

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. Th

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when

Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification f

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:cre

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:select

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in th

An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permissi

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass expose

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prio

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the ex

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file