2026

During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some

During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller fi

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before stor

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-prov

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet

Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permis

A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permi

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrar

Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows at

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values dir

Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function durin

Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connection

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to

Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows

Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded outp

Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry

Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code th

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metach

Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabas

Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames

Ghidra before 12.1 contains a heap-use-after-free vulnerability in SleighBuilder::generatePointerAdd caused by iterator

Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio a

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block th

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block th

Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initializati

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.too

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.too

An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Inter

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debus

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8

The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'grid[properties][borderCol

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all version

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widge

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend

The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and o

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a cus

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL state

A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially

A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially c

A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that

An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could pote

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks m

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vu