2026

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositor

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().

A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attack

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/sec

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 o

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the proces

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A mal

A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A m

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerabilit

A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows rem

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Althoug

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key fil

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to

A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall o

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prio

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final,

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS throu

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT

A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_opaque omits the che

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may

The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after

The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls betwe

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticate

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers

Dell Client BIOS contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privile

Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attac

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definiti

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenti

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 a

An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-

An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC sof

Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint t

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account w

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that al

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site accou

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers wi

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration templa

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in th

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly