2026

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts throu

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attacke

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that all

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-sit

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients wit

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with S

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 202

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Criti

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnera

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with

A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread e

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing al

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with t

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communicati

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between contr

A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to

A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials assoc

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature th

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated

Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnera

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of t

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/p

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certif

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for reci

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that al

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to ci

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoi

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. Thi

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated use

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/cl

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature t