2026

MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle m

MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc

The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form defi

Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenti

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret o

Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affec

In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which

An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18

A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit

In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the se

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in pe

In the Linux kernel, the following vulnerability has been resolved: tcp: secure_seq: add back ports to TS offset This

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_m

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gate: snapshot parameters with RCU o

In the Linux kernel, the following vulnerability has been resolved: nvme: fix memory allocation in nvme_pr_read_keys()

In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_writ

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix potential NULL pointer dereference in

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-size

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_rang

beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious

Missing Authorization vulnerability in Ajay Contextual Related Posts contextual-related-posts allows Exploiting Incorrec

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metada

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass

A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick

A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthentica

A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send a

A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Tel

A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send overs

A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged at

A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacke

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to tri

A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may g

The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter

Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to conf

The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as c

IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authent

The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirect

Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQ

The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on

The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. In versions 2.0.2 through 2.2.4, una

music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF pars

Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnot