2026

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Fire

Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR

Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Fi

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed i

Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox

Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox

Malicious scripts could cause desynchronization between the address bar and web content before a response is received in

A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of

A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of direc

An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab acces

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive use

An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data acces

Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset all

Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially s

IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is on

RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to e

An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows,

Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensiti

DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arb

A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users wit

When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific input

An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor

A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arb

A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arb

A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to crea

Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which

A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/co

The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack du

A vulnerability was detected in SourceCodester Modern Image Gallery App 1.0. Affected by this vulnerability is an unknow

A security vulnerability has been detected in itsourcecode Document Management System 1.0. Affected is an unknown functi

A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the f

A vulnerability has been found in HummerRisk up to 1.5.0. This issue affects the function extractTarGZ/extractZip of the

A flaw has been found in HummerRisk up to 1.5.0. This vulnerability affects the function fixedCommand of the file hummer

Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, t

An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read

A vulnerability was detected in HummerRisk up to 1.5.0. This affects the function CommandUtils.commonExecCmdWithResult o

A security vulnerability has been detected in HummerRisk up to 1.5.0. Affected by this issue is some unknown functionali

A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProje

A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the a

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-o

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1