2026

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unkno

ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the fam

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that c

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that c

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unkno

A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the l

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admi

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisi

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisi

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ para

The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This v

Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validat

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisi

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remo

Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymou

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows a

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue

OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/applicati

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within t

LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenti

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthentica

Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote u

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generato

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to m

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to re

Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or rea

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leak in hci_le_big_

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retr

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553

In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission reso

The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling S

Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload fu

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php en

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could b

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaust

Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may

A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged d

A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API respons

A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issu

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located