2026

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP r

A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.2

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.2

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the G

In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interfac

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial

A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoor

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Medi

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable for Bri

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Prod

claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1

UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to view any user profile o

UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any f

UBB.threads is vulnerable to Blind SQL Injection, allowing attackers with access to the Members in Control Panel to inte

UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input in certain requests, enabling

uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an

UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fails to properly saniti

Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's

A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the de

A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address p

An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" m

Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-appl

A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V3

Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network

Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and pr

An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googl

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googl

SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An atta

The Fancy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' shortcode attr

8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compile

The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortc

Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps

The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenti

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configu

In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could l

The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is

The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysb

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to,