2026

Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript clie

Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) a

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vecto

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverte

Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field wh

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlin

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-read

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()`

A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN)

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on t

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to a

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from na

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

The Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) implemented the dhara_nand_ callbacks so that,

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Lima

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained b

In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the

The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRET

A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the t

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `shoul

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths whe

The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of Pc

Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitiz

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SA

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation

EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resul

Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Colle

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiya Information Techno

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime a

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime a

Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overw

Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document template

Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstat

MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects M

MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit a

The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Re

The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input bef