2026

AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote

LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to

Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic sea

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to creat

Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attacker

Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed docume

Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthentica

LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel.

RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalize

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allo

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers t

A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function whe

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of s

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoi

The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to in

Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 hand

CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptogr

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5

The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientH

Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an u

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computatio

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an auth

Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to

Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and

Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.1

Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitr

Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servl

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attack

In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenti

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged

A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulne

A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerabili

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Acces

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Applicat

A malicious actor with access to the network and under certain network configurations could exploit an Improper Access C

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in Un

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in U

A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper A

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodli