2026

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a l

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileg

A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Ads

A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monito

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive applicati

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust

Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may all

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink reference

An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Ser

An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Servi

An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Ser

An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Servi

An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial o

An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Den

An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial

An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial

An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial o

Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affect

OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel sende

OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote

NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where hand

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that pe

NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controll

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails

Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain a

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject C

Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by

n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expande

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access cou

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP tra

n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger

SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getD

Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authentica

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomed

HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a sin

pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerabilit

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Temp

FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section re

DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can prepare an URL that

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards Serv

OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion en

Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigne

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allo