2026

ChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated i

NPM package next-npm-version1.0.1 is vulnerable to Command injection.

URL redirection to untrusted site ('open redirect') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive

Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that

Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thund

Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Acces

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subseque

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applica

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint v

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes tha

OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation t

OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that expos

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrad

OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper

Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the render

Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configura

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Sessi

In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed c

In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock()

In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-termina

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fil

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_n

In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The le

In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: get correct superblock from den

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-ma

In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->t

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a sessi

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a maliciou

CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementati

PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1

A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function

Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a G

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 t

A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.a

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to crea

OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML par

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTT

In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two

In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks f

A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_white

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthentica

An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset f