2026

Tanium addressed an uncontrolled resource consumption vulnerability in Interact.

Tanium addressed an information disclosure vulnerability in Tanium Server.

Tanium addressed an information disclosure vulnerability in Threat Response.

In order to apply a particular protection key to an address range, the kernel must update the corresponding page table e

The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal

OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows u

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that a

facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_jso

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the Clo

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generati

free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile c

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `r

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, mode

Craft CMS is a content management system (CMS). In versions on the 4.x branch through 4.17.8 and the 5.x branch through

Craft CMS is a content management system (CMS). Versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9

Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have a missing authorization that allows vie

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 have

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may t

free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker t

An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacke

An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to byp

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in AVideo's `ParsedownSa

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in comm

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/vide

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/fun

WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `del

WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll=true)` function in

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks p

WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA l

WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/commentDelete.json.php` is a state-mu

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — `objects/cat

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin acc

Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authentic

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear envi

nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or chan

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is some unknown functionality of

KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there i

Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets

Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token

Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configurati