2026

Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attacke

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST,

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped A

Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows re

Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped A

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for e

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

Tanium addressed a denial of service vulnerability in Tanium Server.

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm

A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the f

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Desig

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Desig

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Webbeyaz Web Desig

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ema

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cro

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spe

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Limatek System Inc

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all ve

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure

The Themehunk Login Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and inclu

The Recurio – Ultimate Subscription for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for Wor

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for co

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeSc

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers auth

Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consu

The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly re

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, th

The PRC file header parsing logic trusts the constructed file structure description information, assumes that the underl

During the PRC parsing stage, there is a lack of boundary verification for the PRC entity index, which leads to an out-o

When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and thi

The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malfo

There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF,

An abnormal image object causes the renderer to enter the wrong processing branch. When converting the scan lines, an in