2026

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated rem

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint p

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component

A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validati

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforc

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load sta

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding th

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 expos

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attacke

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthe

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an un

A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Cli

A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of

An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and th

A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bach

HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert

HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker u

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 all

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown proc

HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.  A

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to intr

A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validat

Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.

Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.

Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.

Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.

Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.

Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown c

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sens

Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.

Unauthenticated Local File Inclusion in Måne <= 1.7 versions.

Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.