2026

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to poten

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs throug

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 all

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H1 A careful

OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Do

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain s

Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommende

Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to ver

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint t

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 T

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform UR

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environm

Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoint that allows authe

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in Defaul

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remo

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which c

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to e

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to r

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive infor

IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sen

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and sessio

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substi

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric ran

Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows C

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows a

The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel a

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, w

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attack

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthe

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment pr

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom r

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able t

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could al

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could al

Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unau

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus f

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to exec

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to p