2026

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON doc

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerabili

Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <NuxtLink> did not vali

Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possibl

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbi

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231)

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability bu

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903)

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only inte

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the toke

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior t

Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user prof

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Inject

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and a

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from vers

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 t

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions

Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to b

The system stores the username and password from the login form after submitting the request. This could allow an attack

A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the fi

A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown

MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a ma

MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading mali

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq

Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, un

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not re

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level p

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial

The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing una

The iRM-IEI Remote Management developed by IEI Integration Corp has a Missing Authentication vulnerability, allowing una

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code exec

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-u

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate res