2026

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate t

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit

Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.

Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thund

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR

Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.3

Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ES

Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Fi

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderb

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.

Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox E

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firef

Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39,

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessi

ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP hand

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP serv

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticat

ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerabil

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuth

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/sr

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contai

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, secti

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exac

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade I

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained a

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informat

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vu

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_al

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convert_ggu

A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the f

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /

A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown functi

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/r

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/accoun

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown par

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles o

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some u

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1,