2026

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to u

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgen

A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shel

HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary c

A vulnerability was identified in omec-project amf up to 2.0.2/2.1.1. Impacted is an unknown function of the file /go/sr

A vulnerability was determined in omec-project amf up to 2.1.1. This issue affects the function RRCInactiveTransitionRep

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. Th

A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.ini

A flaw has been found in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionali

PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to e

A vulnerability was detected in Open5GS up to 2.7.7. Affected by this vulnerability is the function amf_nnrf_handle_nf_d

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, Stanford

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n ru

picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for mal

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to byp

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, all

picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basich

picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to b

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle

picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle redu

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbi

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce meth

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in t

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expres

picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get funct

picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in red

picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_lab

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. A

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Pri

Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function Gatewa

Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to pe

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state w

Permanent Fork PR Workflow Approval Gate Bypass

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Notification API leaks private issue metadata after access revocation

SSRF via HTTP Redirect in Repository Migration

Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execu

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.