2026

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18

This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 1

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1. A malicious application may be

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious a

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be

A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able

HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authentic

A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionali

A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functional

A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file package

A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of t

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list i

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0,

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists

OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in module

ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directl

The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms.

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inpr

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom

YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form

Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type

Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ p

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhook

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0,

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicControll

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint acce

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic.

A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling c

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5, C520WS v2.6 in the HTTP POST bod

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack:

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (

Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds

A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such

A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. Affected by this issue is the function vpn_drop of the fil

A flaw has been found in Trendnet TEW-657BRM 1.00.1. Affected by this vulnerability is the function vpn_connect of the f

A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. Affected is the function ping_test of the file /setup.cgi. P