2026

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimu

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is v

Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands. The method starts a she

Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-co

Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method ScriptRunner.run(String express

An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStr

A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in functi

Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows a

* Countermeasures for DPA within SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually

In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The

Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenti

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "d

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sani

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generat

Imager::File::GIF versions through 1.002 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF file

Permission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability m

Out-of-bounds write vulnerability in the distributed file system module. Impact: Successful exploitation of this vulnera

Permission control vulnerability in the projection module. Impact: Successful exploitation of this vulnerability may aff

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnera

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnera

Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may

Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availabi

Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availabili

Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect ava

Permission control vulnerability in the app management and control module. Impact: Successful exploitation of this vulne

Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availabil

Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421

The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to una

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to time-based blind SQL Injection

The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions u

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and includ

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This

The Smartcat Translator for WPML plugin for WordPress is vulnerable to unauthorized modification of data due to a missin

SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of t

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operat

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all v

The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss du

VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate inherited ACE SID length smb_inher

Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 a

Cross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and ear

Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to per

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to

A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the globa

Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the insta

A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potenti

Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perf