2026

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) a

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated pr

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRo

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider.

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path tr

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Goo

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows a

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based cr

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardle

n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authentic

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writin

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-executio

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoi

There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers

There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to ca

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers t

There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the d

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authenticati

A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traver

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) a

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injec

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with

Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affe

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in a

A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted aud

The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are v

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vuln

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industr

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu

Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 -

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attack

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created throug

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-Use

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthent

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of t

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansio