2026

syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vu

A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earli

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPor

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grp

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to acc

Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might all

Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute work

LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document

LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a c

LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred pars

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restrictio

Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code wh

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the Sa

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not pr

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type valid

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the docume

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulnerability i

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability

The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptogra

The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between t

Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. Thi

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming conne

An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions t

A vulnerability in MISP’s non-REST event editing path allowed an authenticated user with event edit permissions to manip

An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs du

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inse

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisa

A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint pre

An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegatio

A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the

MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. W

An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accou

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify

AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a

Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path

Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron

Actual is a local-first personal finance tool. The `POST /openid/config` endpoint in Actual Budget's sync-server version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8