2026

Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquoted service path vulnerabilities in the WiseBootAssistant and

NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 service that allows l

Windows Firewall Control 4.8.6.0 contains an unquoted service path vulnerability that allows local attackers to escalate

Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in the DragonUpdater serv

Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code w

Comodo Chromodo Browser 52.15.25.664 contains an unquoted service path vulnerability in the ChromodoUpdater service that

Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code

Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer servi

Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attack

There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in Co

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the s

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized acces

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could allow an authenticated user wit

Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can po

Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows

Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly o

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upst

Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default confi

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some

There is a memory leak in NI grpc-device BeginSidebandStream that may result in denial of service due to memory exhausti

There is an unchecked enum cast vulnerability in NI grpc-device BeginSidebandStream that may allow an attacker to trigge

There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attack

There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may

There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an a

Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configuration

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under defaul

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-au

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default

Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under defaul

Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication cap

Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in f

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return suc

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privileg

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authenti

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clus

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read p

Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payloa

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item iden

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reso

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process t

The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all version

Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileg

The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, a

The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.