2026

Heap-based buffer overflow vulnerability in Softing Industrial Automation GmbH smartLink SW-PN and smartLink SW-HT (Webs

Global file reads caused by improper URL checks in webserver in Softing Industrial Automation GmbH smartLinks on docker

soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged u

In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to

A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks

Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-F

An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privi

An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can

An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulne

An information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to obta

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator t

Coppermine Photo Gallery in versions 1.6.09 through 1.6.27 is vulnerable to path traversal. Unauthenticated remote attac

Time-of-check time-of-use race condition in the UEFI PdaSmm module for some Intel(R) reference platforms may allow an in

Exposure of resource to wrong sphere in the UEFI PdaSmm module for some Intel(R) reference platforms may allow an inform

Improper input validation in some UEFI firmware SMM module for the Intel(R) reference platforms may allow an escalation

Improper input validation in the UEFI firmware for some Intel Reference Platforms may allow an escalation of privilege.

Improper buffer restrictions in the UEFI DXE module for some Intel(R) Reference Platforms within UEFI may allow an infor

Improper input validation in the UEFI ImcErrorHandler module for some Intel(R) reference platforms may allow an escalati

Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference platforms may allow an escalation

Time-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may allow an e

Improper input validation in the UEFI WheaERST module for some Intel(R) reference platforms may allow an escalation of p

Improper buffer restrictions in some UEFI firmware for some Intel(R) reference platforms may allow an escalation of priv

Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops

RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScri

rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical

CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code exec

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to 2.1.1, a stored XSS can be i

FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 c

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on a

QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, w

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.

Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: D

The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (

Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability

The Labkotec LID-3300IP has an existing vulnerability in the ice detector software that enables an unauthenticated attac

An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering t

A Blind SQL injection vulnerability has been identified in DobryCMS.  A remote unauthenticated attacker is able to injec

In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection.

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-

The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user

SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attack

A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthe

Featured Image from Content (featured-image-from-content) WordPress plugin versions prior to 1.7 contain an authenticate

Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Script

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated use

Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an

Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtu

The Pelco, Inc. Sarix Professional 3 Series Cameras are vulnerable to an authentication bypass issue in their web manage

A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid