2026

An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Servic

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v

An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site na

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMed

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override hea

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes l

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop cond

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a C

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunction

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experim

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests fro

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fi

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the N

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where cr

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-cont

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule n

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when de

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs w

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attacker

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_s

gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as te

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fai

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authentic

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticat

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint tha

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpo

Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoi

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowin

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to w

filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cl

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes ano

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing at

SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agen

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolut

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue af

A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing.

WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoint

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked esc

Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location tit

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Sav

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response