2026

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for reci

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that al

A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIP_Com_FileList.asp

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function D

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local a

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind cr

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confin

Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192,

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_fu

Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs pe

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echo

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role adm

The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, th

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that r

HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using

A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen

Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication

Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, requir

Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templa

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/te

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file ad

In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify produc

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when return

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-impor

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending me

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthent

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, whic

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrat

The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz ext

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads an

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 a

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impact

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAcc

In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issu

In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local es

In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation

In geniezone, there is a possible out of bounds read due to a missing bounds check. This could lead to local information