2026

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure o

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, sche

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download wr

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prio

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A su

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a N

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an

NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could be able to cause an out-

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privil

NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative

NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator co

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-c

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation

The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by

There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW.  This

There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure o

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure o

The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by p

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLR

The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization.

X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local back

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTT

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-l

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, al

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization an

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger p

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication ru

rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the a

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\Sec

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows auth

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strin

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokeniz

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#in

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths usin

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, a

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attack

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under speci

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External De