2026

Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolv

Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a su

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated

Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay nod

Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to rec

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote cl

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with acc

Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes

Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name t

SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application t

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over

Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriag

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who s

Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban all

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simp

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape v

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting th

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of custome

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files ext

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custo

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attack

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impe

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read acc

Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large arr

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read acc

The cohttp package before 6.3.0 for OCaml allows directory traversal.

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation cri

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role hold

A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action request

A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.2

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfe

Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering acc

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at

Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at

Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentica

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are su

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandEx

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URL

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgi

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow