2026

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the Namespace

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStruc

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In t

The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/f

The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lo

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 1

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. Thi

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Sof

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3

An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Servi

GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged n

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Di

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credential

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attack

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all v

NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSear

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTa

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Prote

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Tal

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Ent

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulne

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability fo

A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CR

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-ena

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inc

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted Fi

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods i

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSa

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type

A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit