2026

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbit

A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote a

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadat

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across project

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another c

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `b

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of `restricte

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 h

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the I

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBacku

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided ba

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromB

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vuln

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance b

Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restrict

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used t

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` i

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August

A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The v

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 thro

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injectio

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Files

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration fu

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompt

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of session

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before renderin

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist ca

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which RE

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification m

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify eve

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned get

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(repo

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user ho

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived e

A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be ret