2026

A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /acco

A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of t

A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. This vulnerability affects unknown cod

A weakness has been identified in Devs Palace ERP Online up to 4.0.0. This affects an unknown part of the file /inventor

A security flaw has been discovered in Devs Palace ERP Online up to 4.0.0. Affected by this issue is some unknown functi

A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. Affected by this vulnerability is an unknown funct

A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function d

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via

A vulnerability was found in Dotouch XproUPF 2.0.0-release-088aa7c4. This impacts the function vlib_worker_loop in the l

A flaw has been found in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /inventory/ite

A vulnerability was detected in Devs Palace ERP Online up to 4.0.0. This affects an unknown function of the file /invent

A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. The impacted element is an unknown fun

A weakness has been identified in Devs Palace ERP Online up to 4.0.0. The affected element is an unknown function of the

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a regist

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/je

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissi

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts

Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0

In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.

In uriparser before 1.0.2, there is pointer difference truncation to int in various places.

In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered wit

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the fil

Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit

A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file sr

A vulnerability was detected in Open5GS up to 2.7.7. Impacted is the function ogs_sbi_stream_find_by_id in the library /

A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the f

Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.

Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close o

Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (m

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-202

Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.

Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload,

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a

Side-channel information leakage in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cros

Insufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who

Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote att

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker

Inappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had com

Race in Shared Storage in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the rendere

Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the ren

Insufficient validation of untrusted input in COOP in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who

Insufficient validation of untrusted input in Persistent Cache in Google Chrome prior to 148.0.7778.96 allowed a remote

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had

HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configur

A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/se

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Ty