2026

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix missing runtime PM reference in ccs_mod

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL deref in bond_debug_rlb_hash

In the Linux kernel, the following vulnerability has been resolved: NFC: nxp-nci: allow GPIOs to sleep Allow the firmw

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix NULL dereference on notify

In the Linux kernel, the following vulnerability has been resolved: crash_dump: don't log dm-crypt key bytes in read_ke

In the Linux kernel, the following vulnerability has been resolved: x86/platform/uv: Handle deconfigured sockets When

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Check set_default_submission() before

In the Linux kernel, the following vulnerability has been resolved: smb: server: make use of smbdirect_socket.send_io.b

In the Linux kernel, the following vulnerability has been resolved: smb: client: make use of smbdirect_socket.recv_io.c

An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Checkout

Cross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary

Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search quer

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at le

The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and Task

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache A

Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache Dolphi

The ITERAS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes (iteras-ordering, i

The Liaison Site Prober plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1

The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3.

The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the I

The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0.

The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This

The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-

MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file owne

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NT

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perfor

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Xibo is an open source digital signage platform with a web content management system and Windows display player software

A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencrypted HTTP for all adm

In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/log

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allo

A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive informat

A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definit

OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operan

OpenClaw before 2026.4.2 fails to filter Slack thread context by sender allowlist, allowing non-allowlisted messages to

OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previ

OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Bas

OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to

OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths