2026

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_nm.php that allows aut

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows a

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows a

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authent

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_JF.php that allows au

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_note.php that allows auth

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authen

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single_unit.php that allows a

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform

ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could e

ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthent

CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Dif

NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes id

NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious

NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data. A succes

NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of t

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to

Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitra

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.26

In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.1

In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could a

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering she

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation.

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not

The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0]

InfoScale CmdServer before 7.4.2 mishandles access control.

Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to for

InfoScale VIOM 9.1.3 allows XSS.

SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.

A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthentica

A vulnerability in the BrowserBot component of Cisco ThousandEyes Enterprise Agent could have allowed an authenticated,

A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, re

A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switc

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not requi

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessi

Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Da

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Floodin

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Sof

The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be

Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Prin

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerabilit

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause i

Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This i

Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthentic

Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanit

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session P

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface

MediaArea MediaInfoLib Channel Splitting heap-based buffer overflow vulnerability

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain circumstances, documen