2026

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerabi

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls M

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative acces

The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set uncondit

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plu

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.1

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers t

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitra

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Cam

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel:

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel:

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Inject

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Came

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9,

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued conn

Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injectio

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5

Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from U

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread net

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code ex

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated

A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Matterm

A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-u

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or

The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. The

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. The

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. The

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, conta

The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->si

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux,

RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocu

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config en

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackdu

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an a

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without esca

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP hea

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arb

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or creden

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Locati

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents ar

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlle