2026

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input.

The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer config

The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backe

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document place

The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on th

Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluate

Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution T

Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. Thi

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue a

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. U

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Us

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFB

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. Thi

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: bef

Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are rec

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') v

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname

Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are r

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints.

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects A

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issu

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects

There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an

A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Key

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file typ

Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Es

Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Man

Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Man

Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot:

Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation.

Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. This

A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registrati

Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amp

This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an att

Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Es

Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot:

Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This is

The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, allow

NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. This issue affects Wa

The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8,

NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution.

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak.