2026

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-loc

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in Defaul

Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attack

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAu

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previous

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Dele

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remo

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to t

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which c

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to e

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to r

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive infor

IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sen

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site sc

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scri

IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnera

IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and sessio

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substi

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric ran

Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows C

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows a

The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel a

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with n

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, w

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attack

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthe

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inj

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to fo

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment pr

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom r

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able t

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions f

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could al

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could al

Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unau