2026

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time compar

Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one wo

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint T

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to wri

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows a

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the appli

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praiso

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is in

PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-gene

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praiso

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praiso

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, w

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege esc

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege esc

SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hij

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. Us

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijackin

SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system adm

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate the

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create syst

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code e

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated int

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate thei

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code e

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary exe

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege esc

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the

A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted elem

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows un

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability tha

Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callb

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability th

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invok

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clien

HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or ma

HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps fu

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-32

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler

In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_stack`) lacks proper

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configura