2026

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, un

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthentic

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query in

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_qu

The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce

/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's bef

The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatin

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database passw

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing

HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to re

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a refer

The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inj

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User

Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensiti

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mo

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Cons

Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking t

A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicio

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralizatio

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection ma

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker wi

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validatio

The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access

The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the Cle

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, AC

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-c

The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoi

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configu

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible form

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attemp

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Wor

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is respo

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flow

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services.

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a gr