CVEs published June 1, 2026

A GitHub Actions workflow (generate-schema.yaml) exposes sensitive credentials (Personal Access Token and SSH signing key) to fork-controlled code due to unsafe checkout and credential handling practices.

A GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens…

Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure.

A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through…

Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation.

Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro allows Privilege Escalation.

SQLChatAgent executes SQL produced by an LLM, which is influenceable by prompt injection.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc.

There is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers.

A critical Remote Code Execution (RCE) vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection.

A buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.

An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass.

Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels.

Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }}")`…

The Capsule Controller runs with cluster-admin privileges.

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.

An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.

IBM i Access Family 1.1.5.0 through 1.1.9.12 IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator.

A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line arguments visible in the pod…

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

The cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories.

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw_to_header() function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted…

A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g.…

SOPlanning does not enforce authorization for backup functionalities.

Memory corruption while using Strongbox due to buffer overflow.

Memory corruption while using Strongbox due to missing bounds check.

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306.

A vulnerability was detected in UTT HiPER 1200GW up to 2.5.3-170306.

A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1.

A security vulnerability has been detected in H3C Magic B0 up to 100R002.

A vulnerability was detected in D-Link DI-8400 up to 16.07.26A1.

A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an…

Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages.

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters.

An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation.

IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component.

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname.

Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier.

Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier.

Pixa Bank 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract sensitive data by injecting SQL code into the 'rib' parameter.

0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a…

ParseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys.

F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied…

FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs.

A reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code.

A reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code.

Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.

AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated…

And 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar.

5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user.

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the…

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the…

Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

This could lead to remote (proximal/adjacent) code execution with User execution privileges needed.

This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed.

Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL…

A flaw was found in rrdcached, a component of rrdtool.

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.

Memory corruption while processing multiple IOCTL command for escape operations.

Memory corruption while processing IOCTL calls for escape operations.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

A flaw was found in Poppler's Splash backend.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify…

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory…

Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image() function within the AI service backend that allows unauthenticated attackers to read…

Missing Authorization vulnerability in Ben Balter WP Document Revisions allows Exploiting Incorrectly Configured Access Control Security Levels.

Authentication Bypass by Spoofing vulnerability in AAM Plugin Advanced Access Manager allows URL Encoding.

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data.

A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path while…

Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform…

FlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP association.

FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism.

FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields.

FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not exist in its registry.

FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails.

FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c).

FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC.

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node.

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field.

FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_REQUEST from the same or spoofed E2 Node.

FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher.

FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages.

FlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no corresponding pending event.

FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent.

Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state…

Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels.

A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0.

A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0.

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0.

A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5.

A security flaw has been discovered in horizon921 mcpilot 0.1.0.

A vulnerability was found in php-censor up to 2.1.6.

A vulnerability was found in SourceCodester Computer Repair Shop Management System up to 1.0.

A vulnerability has been found in code-projects Real State Services 1.0.

A flaw has been found in CodeAstro Online Job Portal 1.0.

A vulnerability was detected in CodeAstro Online Job Portal 1.0.

A vulnerability was detected in itsourcecode Online House Rental System 1.0.

A security vulnerability has been detected in itsourcecode Online House Rental System 1.0.

A weakness has been identified in itsourcecode Online House Rental System 1.0.

A security flaw has been discovered in itsourcecode Online Blood Bank Management System 1.0.

A vulnerability was identified in itsourcecode Online Blood Bank Management System 1.0.

A security vulnerability has been detected in code-projects Smart Parking System 1.0.

A vulnerability has been found in SourceCodester Water Billing Management System 1.0.

A vulnerability has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1.

A flaw has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1.

A vulnerability was detected in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1.

A vulnerability was identified in NousResearch hermes-agent up to 0.12.0.

A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30.

A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3.

A weakness has been identified in zhayujie chatgpt-on-wechat up to 2.0.8.

A flaw has been found in code-projects Online Hospital Management System 1.php.

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an…

Memory Corruption when processing fastboot commands to set display mode.

Memory corruption while processing fastboot commands with improperly formatted input.

Memory corruption while processing fastboot commands with invalid input.

Memory corruption while processing fastboot OEM commands.

Memory Corruption when processing display command line information due to improper initialization of a variable.

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file…

CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS.

Path traversal vulnerability in Apache MINA SSHD bundle sshd-git.

An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS) attacks via crafted…

The following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and…

And 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows DOM-Based XSS.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.Com e2pdf allows Reflected XSS.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS.

Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate Bot Framework bearer tokens by supplying…

The password reset tokenand API key generation uses a weak cryptographical hash algorithm.

And 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not…

An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to…

And 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictions.

A privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers.

A missing permissions check allowed users to request reading form submissions of other users.

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's…

Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mamunur Rashid Classified Listing allows Path Traversal.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS.

Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be bypassed…

A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like `password`, `token`, `secret`, `api_key`) to be bypassed when the JSON value's…

A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. `/etc/passwd` or `airflow.cfg`) or…

An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on…

An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other…

A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0.

This could lead to remote denial of service with no additional execution privileges needed.

This could lead to remote denial of service with no additional execution privileges needed.

This could lead to remote denial of service with no additional execution privileges needed.

This could lead to remote denial of service with no additional execution privileges needed.

This could lead to remote denial of service with no additional execution privileges needed.

This could lead to remote denial of service with no additional execution privileges needed.

This could lead to remote denial of service with no additional execution privileges needed.

And 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via email address who does not have a Nextcloud account), the system…

SOPlanning does not verify uploaded file extension.

SOPlanning is vulnerable to Path Traversal in backup endpoints.

The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

And 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests.

And 33.0.0 to before 33.0.3, when a malicious user has access to a file share of a user, they could use this share token to also access the chunking upload directly and see temporary part files during on…

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables…

A vulnerability was identified in itsourcecode Fees Management System 1.0.

A vulnerability was determined in itsourcecode Fees Management System 1.0.

A vulnerability was found in CodeAstro Payroll System 1.0.

A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1.

A vulnerability was identified in hiraishikentaro wezterm-mcp 0.1.0.

A vulnerability was determined in ishayoyo excel-mcp up to 1.0.2.

A vulnerability was found in j3k0 mcp-google-workspace up to 831790e7d5c2663325733d9f5579cc339a267c4c.

A vulnerability has been found in hekmon8 Jenkins-server-mcp 0.1.0.

A vulnerability was determined in indrasishbanerjee aem-mcp-server up to b5f833aef9b5dfd17a5991b3b18a8a11edbdc583.

A flaw has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0.

A security vulnerability has been detected in decolua 9router up to 0.4.0.

A vulnerability was identified in itsourcecode Content Management System 1.0.

A weakness has been identified in itsourcecode Content Management System 1.0.

A security flaw has been discovered in itsourcecode Content Management System 1.0.

A vulnerability was identified in itsourcecode Content Management System 1.0.

A weakness has been identified in itsourcecode Content Management System 1.0.

A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1.

A vulnerability was identified in JeecgBoot up to 3.9.2.

A vulnerability was determined in JeecgBoot up to 3.9.2.

A flaw has been found in CodeAstro Ingredients Stock Management System 1.0.

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30.

A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3.

A vulnerability was identified in AstrBotDevs AstrBot 4.24.2.

A vulnerability was determined in AstrBotDevs AstrBot 4.23.6.

A vulnerability was found in AstrBotDevs AstrBot 4.23.6.

A vulnerability has been found in code-projects Online Hospital Management System 1.0.

A security vulnerability has been detected in Metasoft 美特软件 MetaCRM 6.4.0.

A weakness has been identified in OFCMS 1.1.3.

A security flaw has been discovered in OFCMS 1.1.3.

A vulnerability was identified in OFCMS 1.1.3.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used `[email]…

And 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints,…

And 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections.

CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploiting improper redirect handling for Amp and…

Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy / a…

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups.

An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion of the webserver.This issue affects OTRS: *…

OOM error is possible while attempting to add infinite amount of functions to Function Registry.

Under infinite recursion in the routing layer, request-handling can cause OOM error.

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.30.

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside…

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local denial of service with User execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata.

Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders.

Lightweight Music Server (LMS) though 3.76.0 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by embedding malicious HTML in media file metadata…

An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient…

A stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions.

A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1.

A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1.

A vulnerability has been found in nextlevelbuilder GoClaw up to 3.11.3.

A security flaw has been discovered in AstrBotDevs AstrBot 4.23.6.

A vulnerability was discovered on Stormshield Network Security  * 4.3.0 to 4.3.41,  * 4.8.0 to 4.8.15,  * 5.0.0 to 5.0.5 It is possible to execute a reflected XSS attack on the login…

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or…

A removed collaborator retains unauthorized read access to uploaded respondent files for the affected form.

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0.

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0.

A weakness has been identified in Assimp up to 6.0.4.

A security flaw has been discovered in Assimp up to 6.0.4.

A vulnerability was identified in Assimp up to 6.0.4.

A vulnerability was determined in Assimp up to 6.0.4.

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30.

SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints.

SOPlanning is vulnerable to Reflected XSS via the taches parameter.

SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint.

The DeepAI endpoint 'https://api.deepai.org/change_user_email' accepts POST requests without any CSRF protection.

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that…

A flaw was found in OpenShift Container Platform.

A flaw has been found in OpenSC up to 0.26.1.

A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0.

A vulnerability was found in SourceCodester Water Billing Management System 1.0.

An improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted.

After unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN.

And 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud…

Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler that allows authenticated room members to exhaust process memory and bandwidth by…

The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection…

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

A null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload.

The view filter criteria is exposed to users with read-only permissions in Nextcloud Tables.

And 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees.

18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission, but no UPDATE permission for a team folder can rename files…

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization.

Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.

In certain cases, an authenticated user performing a numeric reference/search can return results that include resources the requesting user is not authorized to view.

An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on…

A vulnerability has been found in PackageKit up to 1.3.5.

A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0.

A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0.

A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1.

A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1.

This could lead to local escalation with User execution privileges needed.

To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces.

A weakness has been identified in code-projects Online Hospital Management System 1.0.

A flaw was found in gnutls.

An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to access metadata of resources belonging to other users due to insufficient…

A security vulnerability has been detected in SGLang 0.5.10.post1.

A vulnerability was detected in unitedbyai droidclaw up to 0.5.3.

An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and…

An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information.

22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed.

1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link was able to also drop files into other end-to-end…

A vulnerability was determined in lharries whatsapp-mcp 0.0.1.

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0.

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0.

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0.

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0.

A vulnerability was detected in Mettle sendportal up to 3.0.1.

A vulnerability was found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1.

An attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC.

Authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval.

This could lead to local information disclosure with no additional execution privileges needed.

A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2.

A vulnerability was found in SourceCodester Customer Review App 1.0.

A weakness has been identified in janet-lang janet up to 1.41.0.

A security flaw has been discovered in janet-lang janet up to 1.41.0.

A security vulnerability has been detected in Assimp up to 6.0.4.

A vulnerability was determined in Assimp up to 6.0.4.

This could lead to local information disclosure with no additional execution privileges needed.

This could lead to local information disclosure with no additional execution privileges needed.

This could lead to local information disclosure with no additional execution privileges needed.

Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag.

The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags.

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.

A missing access check on API level allowed to add unknown circles by their ID directly to other circles.

When a previous collective pages was deleted and the collective was shared view-only, guests with access to the collective were able to access the deleted pages directly from the trashbin.