2026

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML s

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remot

Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17,

The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certi

Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows

SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitra

Unrestricted upload of file with dangerous type vulnerability in Limatek System Inc. LimRAD NAC allows Remote Code Inclu

Improper neutralization of special elements used in an expression language statement ('expression language injection') v

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers

An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex X

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd p

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or tr

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN),

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connecti

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a s

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PO

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PU

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vu

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vu

QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee componen

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerabil

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could re

An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass

A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to

An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function allows remote attack

Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network

Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.

Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.