2026

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allo

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milk

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensyste

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. P

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA ba

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that a

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious S

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ss

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators t

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the P

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allo

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract ar

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via C

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated at

Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administ

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs()

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pci_iounmap() with offset when PEER

In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS in copy_process() P

In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from land

In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stop_this_cpu

In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-free in child_regions_w

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stop_this_cpu

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when queryi

In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-poweroff: fix use-after-f

In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode()

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem->altmap after successf

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds c

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe erro

In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks A

In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup p

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regi

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent

In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - validate firmware size before use

In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in d

In the Linux kernel, the following vulnerability has been resolved: tty: serial: pch_uart: add check for dma_alloc_cohe

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts->lock across XU walks i

In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_inser

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped r

In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irq_data.rdev not being as

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB flush when PCID is di