2026

Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to by

CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. The minif

luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKe

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows

Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx all

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_mes

Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated acc

Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before as

Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to e

Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unau

SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other org

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary C

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSorting

Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_web

Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfi

ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderCon

ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that al

Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attacke

PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin us

LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get_remote_address()

Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that re

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that all

Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attacker

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/passwor

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded defaul

Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem.

A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issu

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstr

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attac

Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request for

A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/

A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength

A vulnerability was identified in seladb PcapPlusPlus 25.05. This affects the function pcpp::TelnetLayer::getSubCommand

A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMe

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLo

An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2

Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials

Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 a

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file conten

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL ex

Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verifica

A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the