2026

VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and e

VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and e

EduSoho versions prior to 22.4.7 contain an arbitrary file read vulnerability in the classroom-course-statistics export

MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permis

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by

Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. 

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java ap

ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in

Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Ja

User-controlled header names and values containing newlines can allow injecting HTTP headers.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messa

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigati

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigat

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not b

A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext

A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secre

Multiple denial-of-service vulnerabilities exist in the affected product. These issues can be triggered through various

A denial-of-service security issue in the affected product. The security issue occurs when a malformed CIP forward open

HTML injection vulnerability in multiple Botble products such as TransP, Athena, Martfury, and Homzen, consisting of an

Reflected Cross-Site Scripting (XSS) vulnerability in IsMyGym by Zuinq Studio. This vulnerability allows an attacker to

HTML Injection vulnerability in Isshue by Bdtask, consisting os an HTML injection due to a lack os proper validation

Reflected Cross-Site Scripting (XSS) vulnerability in Riftzilla's QRGen. This vulnerability allows an attavker to execut

Stored Cross-Site Scripting (XSS) vulnerability in Sesame web application, due to the fact that uploaded SVG images are

The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-

Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and pr

Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site

GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extend

Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models all

Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU

Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_up

Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to

Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenti

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to exe

TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted out

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Use spinlock for context l

In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enume

Y Soft SafeQ 6 renders the Workflow Connector password field in a way that allows an administrator with UI access to rev

A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as wel

Lack of authorization of the InputManager D-Bus interface in InputPlumber versions before v0.63.0 can lead to local Deni

Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assi

Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability,

In the Linux kernel, the following vulnerability has been resolved: f2fs: invalidate dentry cache on failed whiteout cr

In the Linux kernel, the following vulnerability has been resolved: ntfs: set dummy blocksize to read boot_block when m

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadlock As Jiaming Z

In the Linux kernel, the following vulnerability has been resolved: net: hns3: using the num_tqps in the vf driver to a

In the Linux kernel, the following vulnerability has been resolved: fuse: fix readahead reclaim deadlock Commit e26ee4