2026

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization by

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization by

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-chann

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records.

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by doub

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Ten

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly

A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PA

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unau

IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prio

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string pre

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF pr

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limi

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded f

OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the c

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to t

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpo

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpo

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending

Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent atta

Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() functio

Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configur

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Aj

An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a direc

Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_v

Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitra

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed a

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitra

A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated,

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low

A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could all

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal a

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary comman

A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PI

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an au

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitr

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitr

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote att

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote a

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote a

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Mar

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design You