2026

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta

When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

This vulnerability exists in the Atom 3x Projector due to improper exposure of the Android Debug Bridge (ADB) service ov

Mercure is a protocol for pushing data updates to web browsers and other HTTP clients in a battery-efficient way. Prior

A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that al

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an a

Cleartext Storage of Sensitive Information in GUI vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and pr

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mi

An exposed IOCTL with an  insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) w

Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki

Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExper

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundati

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to

The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmwa

The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability

An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware

Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Ex

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension

A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Auto

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R2

A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user account

The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prio

SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dyna

Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched

A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a vict

The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attack

SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which co

A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/{EVENTID}/{TIME

AL-KO Robolinho Update Software has hard-coded AWS Access and Secret keys that allow anyone to access AL-KO's AWS bucket

A Privilege Dropping / Lowering Errors/Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in  cosmic-greete

User enumeration in ESET Protect (on-prem) via Response Timing.

Hardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user

elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results i

A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attac

Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that

Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Exte

Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to

A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or

Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other u

Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other u

Incorrect privilege assignment vulnerability in HYPR Server allows Privilege Escalation.This issue affects HYPR Server:

From Panorama Web HMI, an attacker can gain read access to certain Web HMI server files, if he knows their paths and if

Injection vulnerabilities due to validation/sanitisation of user-supplied input in ActiveMatrix BusinessWorks and Enterp

A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version