CVE-2026-48022 - @hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Au

CVE-2026-44979 - @hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a

CVE-2026-55518 - Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51,

CVE-2026-54498 - view_component is a framework for building reusable, testable, and encapsulated view components in R

CVE-2026-54497 - view_component is a framework for building reusable, testable, and encapsulated view components in R

CVE-2026-54490 - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library

CVE-2026-54466 - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame forma

CVE-2026-54244 - Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, t

CVE-2026-54243 - Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1,

CVE-2026-54242 - Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1,

CVE-2026-54163 - secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secu

CVE-2026-54159 - PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4

CVE-2026-53727 - css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/c

CVE-2026-52584 - Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensit

CVE-2026-52348 - cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.

CVE-2026-52203 - An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source par

CVE-2026-50274 - Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling

CVE-2026-50272 - dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in package

CVE-2026-50271 - Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that

CVE-2026-49977 - tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.

CVE-2026-48062 - CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in

CVE-2026-45785 - OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also kno

CVE-2026-45784 - rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80

CVE-2026-44891 - Netty is a network application framework for development of protocol servers and clients. Prior to 4

CVE-2026-16074 - A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_p

CVE-2026-13446 - IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptog

CVE-2026-13445 - IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile

CVE-2026-8861 - IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed te

CVE-2026-8859 - IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to u

CVE-2026-8635 - IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser

CVE-2026-8505 - IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic

CVE-2026-8481 - IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the

CVE-2026-8476 - IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the

CVE-2026-8056 - IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at

CVE-2026-7872 - IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files inclu

CVE-2026-7771 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a sp

CVE-2026-7755 - IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete v

CVE-2026-7754 - IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF)

CVE-2026-7667 - IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow po

CVE-2026-7364 - IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1

CVE-2026-63030 - WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route c

CVE-2026-60137 - WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise

CVE-2026-55254 - NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator i

CVE-2026-54465 - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-

CVE-2026-54464 - ### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket s

CVE-2026-54463 - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions

CVE-2026-54171 - Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware

CVE-2026-52199 - An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar

CVE-2026-51833 - Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add

CVE-2026-50289 - systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterf

CVE-2026-50197 - Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipp

CVE-2026-50163 - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/u

CVE-2026-50162 - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/fi

CVE-2026-50151 - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in

CVE-2026-4942 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message an

CVE-2026-4938 - IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1

CVE-2026-49852 - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encry

CVE-2026-49834 - sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier config

CVE-2026-49284 - SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7

CVE-2026-48978 - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm UR

CVE-2026-48819 - Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3,

CVE-2026-48504 - OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagato

CVE-2026-48373 - Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitr

CVE-2026-46420 - setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers,

CVE-2026-45799 - Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0

CVE-2026-45704 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6,

CVE-2026-45260 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7,

CVE-2026-44974 - @hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retaine

CVE-2026-44739 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6,

CVE-2026-43636 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-42168 - django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fi

CVE-2026-36669 - An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.

CVE-2026-16118 - A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_

CVE-2026-15995 - IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an at

CVE-2026-15415 - AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow en

CVE-2026-15322 - IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive inf

CVE-2026-15093 - IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to ma

CVE-2026-15091 - IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary sc

CVE-2026-15069 - IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary sc

CVE-2026-14979 - IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Inte

CVE-2026-14971 - IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguratio

CVE-2026-14501 - IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitra

CVE-2026-14499 - IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrar

CVE-2026-13473 - IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Stora

CVE-2026-13448 - IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution

CVE-2026-12283 - Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amaz

CVE-2025-51678 - An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory add

CVE-2025-51677 - An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and the

CVE-2026-9171 - IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial

CVE-2026-9135 - IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163

CVE-2026-9103 - IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due

CVE-2026-58195 - Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools i

CVE-2026-53712 - SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentic

CVE-2026-52746 - JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matchin

CVE-2026-50185 - RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to

CVE-2026-49835 - Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the globa

CVE-2026-48487 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _rea

CVE-2026-48045 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, Asyn

CVE-2026-47184 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCa

CVE-2026-47183 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIn

CVE-2026-47180 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIn

CVE-2026-45703 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7,

CVE-2026-45309 - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the

CVE-2026-45162 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7,

CVE-2026-16073 - A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this iss

CVE-2026-9762 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when

CVE-2026-9202 - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user acco

CVE-2026-9198 - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (

CVE-2026-50273 - Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Data

CVE-2026-48016 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /stor

CVE-2026-48015 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed

CVE-2026-48014 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition f

CVE-2026-48010 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser()

CVE-2026-48009 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user w

CVE-2026-48008 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with in

CVE-2025-59866 - The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Lea

CVE-2026-9588 - A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (10499

CVE-2026-9587 - An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104

CVE-2026-9586 - An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).

CVE-2026-9585 - An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SM

CVE-2026-8297 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-63309 - SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing au

CVE-2026-63308 - Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files

CVE-2026-63307 - Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/conn

CVE-2026-63101 - Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthe

CVE-2026-57860 - ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the M

CVE-2026-54496 - ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard

CVE-2026-49216 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus co

CVE-2026-49215 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\Liv

CVE-2026-49212 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC comput

CVE-2026-49211 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Auto

CVE-2026-49210 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\Live

CVE-2026-49209 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\Live

CVE-2026-49208 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LivePr

CVE-2026-44722 - pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prio

CVE-2026-21764 - HCL DevOps Loop is affected by insufficient input validation that allows special characters where th

CVE-2026-21762 - HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce br

CVE-2026-21761 - HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper COR

CVE-2026-21760 - HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulne

CVE-2026-16108 - A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This comp

CVE-2026-16106 - A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. T

CVE-2026-16104 - A flaw was found in the authentication configuration endpoint of the keycloak-services component, wh

CVE-2026-16103 - A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for

CVE-2026-16093 - Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, su

CVE-2026-12694 - Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Func

CVE-2026-12693 - Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Pla

CVE-2026-12692 - Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentic

CVE-2026-12691 - Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platfor

CVE-2026-11763 - Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consul

CVE-2026-9537 - Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string compa

CVE-2026-63100 - Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-pri

CVE-2026-63099 - TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment

CVE-2026-63098 - TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows

CVE-2026-63097 - Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context en

CVE-2026-63096 - Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthentic

CVE-2026-63095 - Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server

CVE-2026-60025 - Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extens

CVE-2026-60024 - Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Jo

CVE-2026-58149 - Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extens

CVE-2026-58148 - Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52 -

CVE-2026-15783 - A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an aut

CVE-2026-15343 - A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker w

CVE-2026-15007 - A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authent

CVE-2026-14871 - osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to

CVE-2026-14741 - HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in p

CVE-2026-12715 - Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud P

CVE-2026-63094 - SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that al

CVE-2026-63093 - Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attack

CVE-2026-51083 - Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x b

CVE-2026-51082 - A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE

CVE-2026-51081 - A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmo

CVE-2026-16089 - A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs b

CVE-2026-16017 - A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/r

CVE-2026-12705 - Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool

CVE-2026-9592 - SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay

CVE-2026-7488 - Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce a

CVE-2026-51080 - libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External

CVE-2026-16072 - A flaw was found in the organization management component of Keycloak. A delegated administrator wit

CVE-2026-16016 - A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run

CVE-2026-16015 - A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the func

CVE-2025-60357 - AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via

CVE-2024-42214 - HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server.

CVE-2024-23578 - HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin reso

CVE-2024-23577 - HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header a

CVE-2024-23575 - HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages th

CVE-2024-23574 - HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-

CVE-2024-23573 - HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that ma

CVE-2024-23572 - HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may

CVE-2024-23571 - HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate cachi

CVE-2024-23570 - HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack tec

CVE-2024-23569 - HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protectio

CVE-2024-23568 - HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the applicati

CVE-2024-23567 - HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows applica

CVE-2024-23566 - HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha impl

CVE-2024-23565 - HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail l

CVE-2024-23564 - HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the

CVE-2026-8396 - Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS a

CVE-2026-7189 - Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's

CVE-2026-16014 - A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unkno

CVE-2026-13410 - Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The defa

CVE-2026-13082 - GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method cr

CVE-2026-16013 - A vulnerability has been found in liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760.

CVE-2026-16009 - A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown

CVE-2026-15943 - A flaw was found in the Keycloak keycloak-services component, which handles the management of identi

CVE-2026-9602 - Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Matterm

CVE-2026-8075 - Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for h

CVE-2026-59695 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote c

CVE-2026-59694 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote c

CVE-2026-59252 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote c

CVE-2026-16008 - A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts