2026

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attack

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose i

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor previ

Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated

Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges ove

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. Th

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This un

Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges

Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unaut

Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attac

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code ove

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) all

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code ove

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthoriz

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthoriz

A security vulnerability has been detected in code-projects Feedback System 1.0. Impacted is an unknown function of the

A security flaw has been discovered in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the fi

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In ve

Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orche

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.

Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internat

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use

A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the

A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frm

manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assi

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum databa

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-

ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.

Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT sess

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds,

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute wit

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite functi

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribu

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp").

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sa

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it recei

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file f

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the f

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as e

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPyt

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_

GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitP