2026

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attack

Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenti

An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authen

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read

A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges

An incorrect permission assignment for critical resource of Ivanti Secure Access Client   before 22.8R6 allows a local a

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclo

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper tha

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, Th

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature acc

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger (YAFNE

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgr

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The f

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Fir

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3,

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause un

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterp

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76

pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomple

Dell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability

Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_all

Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits

Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could

CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the networ

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Trave

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Emb

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elemento

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR wo

Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Exploiting

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExpe

Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPF

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms V

A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an uninte

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in

The application does not impose strict enough restrictions on directory access permissions, posing a risk that other mal

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry an

[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/f

[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/f

[email protected] and lower versions are vulnerable to denial of service via regular expression backtracking in the Conte

Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Boar