2026

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vi

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimbal

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupw

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen va

Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[]

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c acce

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to in

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected t

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to ma

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected de

A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code ex

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init ca

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesse

TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the bu

A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup o

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contai

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute ar

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interp

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenti

n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (searc

n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operati

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An aut

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Gi

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated us

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for

n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, w

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability relate

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Soft

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upg

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /acco

Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feat

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoi

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's

Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can cont

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface usi

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap t

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first

Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report ex

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, wher

Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contain