2026

CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execut

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, d

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated a

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, intern

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, intern

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, intern

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite agg

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite func

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index pred

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-t

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG i

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpol

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affec

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before in

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An atta

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with acces

Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tec

Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitra

Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form proce

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fai

Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated at

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a s

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP

The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` me

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with li

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLE_ATTR_DATA p

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision strin

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - fix OOB read in pefile_di

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in accept_untracked_na(

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configu

Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped sp

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, trans

Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains

A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch

Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authe

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2