CVEs published January 27, 2026
196 CVEs were published on January 27, 2026: 50 critical, 75 high. 1 is now in CISA KEV.
- Published
- 196
- Critical
- 50
- High
- 75
- Medium
- 67
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 123
Most affected products
- OpenSSL
- 12
- Quatuor Evaluación de Desempeño
- 12
- OISF suricata
- 7
- EZCast Pro II
- 5
- dnnsoftware Dnn.Platform · DotNetNuke.Core
- 4
- honojs hono · hono
- 4
- Red Hat Enterprise Linux
- 4
- Beckhoff Automation Beckhoff.Device.Manager.XAR · Beckho… +1
- 3
- GnuPG
- 3
- ixray-team ixray-1.6-stcop
- 3
Critical 50
- CVE-2026-24838DotNetNuke.Core Vulnerable to Stored XSS via Module Titlednnsoftware Dnn.Platform · DotNetNuke.Core
- CVE-2026-23830SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructornyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-24770RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParserinfiniflow ragflow
- CVE-2026-24736Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configurationsquidex
- CVE-2025-21589Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerabilityJuniper Networks Session Smart Router · Juniper Networks… +1
- CVE-2025-14988Incorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDAiba Systems ibaPDA
- CVE-2026-24858An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.Fortinet FortiWeb · Fortinet FortiNAC-F +4
- CVE-2026-1483Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1482Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1481Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1480Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1479Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1478Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1477Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1476Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1475Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1474Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1473Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-1472Out-of-band SQL injection in Quatuor Performance EvaluationQuatuor Evaluación de Desempeño
- CVE-2026-22039Kyverno Cross-Namespace Privilege Escalation via Policy apiCallkyverno · github.com/kyverno/kyverno
- CVE-2026-24874Type confusion in xray-monoliththemrdemonized xray-monolith
- CVE-2025-68670xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflowneutrinolabs xrdp
- CVE-2026-24872Pointer arithmetic error in SkyFire_548ProjectSkyfire SkyFire_548
- CVE-2026-24871Code injection in Minecraft-Rcon-Managepilgrimage233 Minecraft-Rcon-Manage
- CVE-2026-24832Out-of-bounds write in ixray-1.6-stcopixray-team ixray-1.6-stcop
- CVE-2021-47900Gila CMS < 2.0.0 - Remote Code ExecutionGila CMS
- CVE-2026-1470Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.n8n
- CVE-2026-24830Integer Overflow or Wraparound in IronOSRalim IronOS
- CVE-2026-24826Out-of-bounds write in turso3dcadaver turso3d
- CVE-2026-24823A heap-based buffer over-read or buffer overflow vulnerability in FASTSHIFT/X-TRACKFASTSHIFT X-TRACK
- CVE-2026-24822a heap-based buffer overflow vulnerability in ttttupup/wxhelper via src/mongoose.ttttupup wxhelper
- CVE-2026-24821A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in turanszkij/WickedEngine.turanszkij WickedEngine
- CVE-2026-24816Cookie Security Vulnerabilities in datavane/tisdatavane tis
- CVE-2026-24815A XStream Security Vulnerability in XML Deserialization in datavane/tisdatavane tis
- CVE-2026-24814A integer overflow in swoole/swoole-srcswoole-src
- CVE-2026-24812An improper pointer arithmetic in root-project/root at builtins/zlib/inftrees.croot-project root
- CVE-2026-24811An improper pointer arithmetic in root-project/root at builtins/zlib/inffast.croot-project root
- CVE-2026-24810A buffer overflow in rethinkdb/rethinkdbrethinkdb
- CVE-2026-24804A infinite loop vulnerability in coolsnowwolf/ledecoolsnowwolf lede
- CVE-2026-24803A possible infinite loop vulnerability in coolsnowwolf/ledecoolsnowwolf lede
- CVE-2026-24800A heap-based buffer over-read or buffer overflow in tildearrow/furnacetildearrow furnace
- CVE-2026-24798An Uninitialized stack variable vulnerability in GaijinEntertainment/DagorEngineGaijinEntertainment DagorEngine
- CVE-2026-24794Chunk Unloading Security Vulnerability in CardboardPowered/cardboardCardboardPowered cardboard
- CVE-2026-24793A heap-based buffer over-read or buffer overflow vulnerability in azerothcore/azerothcore-wotlkazerothcore-wotlk
- CVE-2026-24479HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCEzhblue hustoj
- CVE-2025-69559code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php.
- CVE-2025-69562code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter.
- CVE-2025-69563code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter.
- CVE-2025-69564code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName,
- CVE-2025-69565code-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php.
High 75
- CVE-2026-24837DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modaldnnsoftware Dnn.Platform · DotNetNuke.Core
- CVE-2026-24836DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotesdnnsoftware Dnn.Platform · DotNetNuke.Core
- CVE-2026-24833DotNetNuke.Core Vulnerable to Stored XSS in Module Descriptiondnnsoftware Dnn.Platform
- CVE-2026-24785Clatter has a PSK Validity Rule Violation issuejmlepisto clatter · clatter
- CVE-2025-55292In Meshtastic, an attacker can spoof licensed amateur flag for a nodemeshtastic firmware
- CVE-2025-67645OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpointopenemr
- CVE-2025-54373OpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilegeopenemr
- CVE-2026-24783soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negativesscript3 soroban-fixed-point-math · soroban-fixed-point-math
- CVE-2026-24779vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`vllm-project vllm · vllm
- CVE-2026-24778Ghost vulnerable to XSS via malicious Portal preview linksTryGhost Ghost · ghost +1
- CVE-2026-24765PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handlingsebastianbergmann phpunit · phpunit/phpunit
- CVE-2026-24747PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Filespytorch · torch
- CVE-2026-24741ConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`C4illin ConvertX
- CVE-2026-24740Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Accessamir20 dozzle · github.com/amir20/dozzle
- CVE-2020-36983Quick 'n Easy FTP Service 3.2 - Unquoted Service PathPablosoftwaresolutions Quick 'n Easy FTP Service
- CVE-2020-36982Motorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service PathMotorola-Device-Manager Motorola Device Manager
- CVE-2020-36981Motorola Device Manager 2.4.5 - 'ForwardDaemon.exe ' Unquoted Service PathFilehorse Motorola Device Manager
- CVE-2020-36980SAntivirus IC 10.0.21.61 - 'SAntivirusIC' Unquoted Service PathSegurazo SAntivirus IC
- CVE-2020-36979Atheros Coex Service Application 8.0.0.255 -'ZAtheros Bt&Wlan Coex Agent' Unquoted Service PathAtheros Coex Service Application
- CVE-2020-36977Wondershare Driver Install Service help 10.7.1.321 - 'ElevationService' Unquote Service PathWondershare Driver Install Service help
- CVE-2020-36976Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service PathAcer Global Registration Service
- CVE-2020-36975EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service PathSEIKO EPSON Status Monitor
- CVE-2020-36974Realtek Andrea RT Filters 1.0.64.7 - 'AERTSr64.EXE' Unquoted Service PathRealtek Andrea RT Filters
- CVE-2026-24882In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and EGnuPG
- CVE-2026-24881In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffeGnuPG
- CVE-2026-22264Suricata detect/alert: heap-use-after-free on alert queue expansionOISF suricata
- CVE-2026-23593Unauthenticated Limited File Read allows Data Exposure in Web InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…
- CVE-2025-33234NVIDIA runx contains a vulnerability where an attacker could cause a code injection.NVIDIA runx
- CVE-2026-23592Insecure File Handling allows Remote Code Execution in Backup FunctionalityHewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…
- CVE-2026-1315Unauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WSTP-Link Systems Tapo C220 · TP-Link Systems Tapo C520WS
- CVE-2026-0919Unauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WSTP-Link Systems Tapo C220 · TP-Link Systems Tapo C520WS +1
- CVE-2026-0918Null Pointer Dereference in Tapo SmartCam HTTP Service on TP-Link Tapo C220 & C520WSTP-Link Systems Tapo C220 · TP-Link Systems Tapo C520WS +1
- CVE-2026-22260Suricata http1: infinite recursion in decompressionOISF suricata
- CVE-2025-14911Integer Overflow in GridFS chunkSize Leading to Heap Allocation FailureMongoDB Mongo-c-driver
- CVE-2026-22259Suricata dnp3: unbounded transaction growthOISF suricata
- CVE-2026-22258Suricata DCERPC: unbounded fragment buffering leads to memory exhaustionOISF suricata
- CVE-2026-23881Kyverno Denial of Service via Context Variable Amplification in Policy Enginekyverno · github.com/kyverno/kyverno
- CVE-2025-69421NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex functionOpenSSL
- CVE-2025-69420Missing ASN1_TYPE validation in TS_RESP_verify_response() functionOpenSSL
- CVE-2025-69419Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversionOpenSSL
- CVE-2025-15467Stack buffer overflow in CMS (Auth)EnvelopedData parsingOpenSSL
- CVE-2026-24869Use-after-free in the Layout: Scrolling and Overflow componentMozilla Firefox
- CVE-2026-24875Integer overflow in modizeryoyofr modizer
- CVE-2026-24873Out-of-bounds read in lpp-vitaRinnegatamante lpp-vita
- CVE-2026-24831Infinite loop (DoS) in ixray-1.6-stcopixray-team ixray-1.6-stcop
- CVE-2026-0648The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layersEclipse Foundation Eclipse ThreadX
- CVE-2025-55102A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo.Eclipse Foundation Eclipse ThreadX - NetX Duo
- CVE-2021-47902Testa Online Test Management System 3.4.7 - 'q' SQL InjectionTesta Online Test Management System
- CVE-2020-36951Phpscript-sgh 0.1.0 - Time Based Blind SQL Injectiongeraked phpscript-sgh
- CVE-2020-36950Laravel Nova 3.7.0 - 'range' DoSLaravel Holdings Laravel Nova
- CVE-2020-36948VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session ValidationVestaCP
- CVE-2020-36947LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL InjectionLibreNMS · librenms/librenms
- CVE-2020-36946SyncBreeze 10.0.28 - 'login' Denial of ServiceFlexense SyncBreeze
- CVE-2020-36942Victor CMS 1.0 - File Upload To RCEVictorAlagwu CMSsite
- CVE-2020-36939Cassandra Web 0.5.0 - Remote File Readavalanche123 Cassandra Web · cassandra-web
- CVE-2020-36938WinAVR Version 20100110 - Insecure Folder PermissionsWinAVR
- CVE-2025-41727Beckhoff: Performing privileged operations and gaining administrator accessBeckhoff Automation Beckhoff.Device.Manager.XAR · Beckho… +1
- CVE-2025-41726Beckhoff: Arbitrary code execution within privileged processesBeckhoff Automation Beckhoff.Device.Manager.XAR · Beckho… +1
- CVE-2026-24348Multiple cross-site scripting vulnerabilities in EZCast Pro II DongleEZCast Pro II
- CVE-2026-21417Dell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability.Dell CloudBoost Virtual Appliance
- CVE-2026-24346Use of well-known default credentials in EZCast Pro II DongleEZCast Pro II
- CVE-2026-24828Memory leak in is-EngineIs-Daouda is-Engine
- CVE-2026-24827Out-of-bounds write in Commander-Geniusgerstrong Commander-Genius
- CVE-2026-21721Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalationgrafana/grafana · grafana/grafana-enterprise
- CVE-2026-21720Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outgrafana/grafana-enterprise · grafana/grafana
- CVE-2026-24344Multiple Buffer Overflows in EZCast Pro II DongleEZCast Pro II
- CVE-2026-24817A potential heap-buffer overflow in praydog/UEVRpraydog UEVR
- CVE-2026-24813A null pointer dereference in abcz316/SKRoot-linuxKernelRootabcz316 SKRoot-linuxKernelRoot
- CVE-2026-24808A possible integer overflow vulnerability in RawTherapee/RawTherapeeRawTherapee
- CVE-2026-1465A heap-based buffer over-read or buffer overflow in tildearrow/furnaceanyrtcIO-Community anyRTC-RTMP-OpenSource
- CVE-2026-21408beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic LinFUJIFILM Business Innovation beat-access for Windows
- CVE-2026-1361ASDA-Soft Stack-based Buffer Overflow VulnerabilityDelta Electronics ASDA-Soft
- CVE-2026-24490MobSF has Stored XSS via Manifest Analysis - Dialer Code Host FieldMobile-Security-Framework-MobSF · mobsf
- CVE-2026-24486Python-Multipart has Arbitrary File Write via Non-Default ConfigurationKludex python-multipart · python-multipart
- CVE-2026-24480QGIS had validated RCE and Repository Takeover via GitHub ActionsQGIS
Medium, low and unrated 71
- CVE-2026-24784DotNetNuke.Core has a potential XSS vulnerability in modules' header and footerdnnsoftware Dnn.Platform · DotNetNuke.Core
- CVE-2026-24134StudioCMS has an Authorization Bypass Through User-Controlled Keywithstudiocms studiocms · studiocms
- CVE-2026-24910In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matchBun
- CVE-2026-24909vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.vlt · @vltpkg/tar
- CVE-2026-24748Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated accessakuity kargo · github.com/akuity/kargo
- CVE-2026-24738gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Valuesgmrtd · github.com/gmrtd/gmrtd
- CVE-2026-1504Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker to leak cross-originGoogle Chrome
- CVE-2025-12810Failure in Password Rotation and Check-in Mechanism in Secret Server Allows Reuse of CredentialsDelinea Secret Server On-Prem
- CVE-2026-24688pypdf has possible Infinite Loop when processing outlines/bookmarkspy-pdf pypdf · pypdf
- CVE-2026-24771Hono has a Cross-site Scripting vulnerabilityhonojs hono · hono
- CVE-2026-24473Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)honojs hono · hono
- CVE-2026-24472Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deceptionhonojs hono · hono
- CVE-2026-24398Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofinghonojs hono · hono
- CVE-2026-24116Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64bytecodealliance wasmtime · wasmtime
- CVE-2020-36978Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site ScriptingFroxlor Froxlor Server Management Panel
- CVE-2026-24883In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leadinGnuPG
- CVE-2026-23892OctoPrint has Timing Side-Channel Vulnerability in API Key AuthenticationOctoPrint
- CVE-2026-0746AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgerytigroumeow AI Engine – The Chatbot, AI Framework & MCP for…
- CVE-2026-22263Suricata http1: quadratic complexity in headers parsing over multiple packetsOISF suricata
- CVE-2026-22262Suricata datasets: stack overflow when saving a setOISF suricata
- CVE-2026-22261Suricata eve/alert: http1 xff handling can lead to denial of serviceOISF suricata
- CVE-2026-0705Local privilege escalation due to insecure folder permissions.Acronis Cloud Manager
- CVE-2026-22796ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() functionOpenSSL
- CVE-2026-22795Missing ASN1_TYPE validation in PKCS#12 parsingOpenSSL
- CVE-2025-69418Unauthenticated/unencrypted trailing bytes with low-level OCB function callsOpenSSL
- CVE-2025-68160Heap out-of-bounds write in BIO_f_linebuffer on short writesOpenSSL
- CVE-2025-66199TLS 1.3 CompressedCertificate excessive memory allocationOpenSSL
- CVE-2025-15469'openssl dgst' one-shot codepath silently truncates inputs >16MBOpenSSL
- CVE-2025-15468NULL dereference in SSL_CIPHER_find() function on unknown cipher IDOpenSSL
- CVE-2025-11187Improper validation of PBMAC1 parameters in PKCS#12 MAC verificationOpenSSL
- CVE-2026-24868Mitigation bypass in the Privacy: Anti-Tracking componentMozilla Firefox
- CVE-2026-24870Information disclosure in ixray-1.6-stcopixray-team ixray-1.6-stcop
- CVE-2025-55095The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device.Eclipse Foundation Eclipse ThreadX - USBX
- CVE-2021-47901dirsearch 0.4.1 - CSV Injectionmaurosoria dirsearch
- CVE-2020-36949TapinRadio 2.13.7 - Denial of ServiceRaimersoft TapinRadio
- CVE-2020-36941Knockpy 4.1.1 - CSV Injectionguelfoweb knock
- CVE-2020-36940Easy CD & DVD Cover Creator 4.13 - Denial of ServiceTucows Easy CD & DVD Cover Creator
- CVE-2026-1489Glib: glib: memory corruption via integer overflow in unicode case conversionRed Hat Enterprise Linux
- CVE-2026-1213Askbot 0.12.2 - Insecure Direct Object Reference (IDOR)askbot
- CVE-2026-1485Glib: glib: local denial of service via buffer underflow in content type parsingRed Hat Enterprise Linux
- CVE-2026-1484Glib: integer overflow leading to buffer underflow and out-of-bounds write in glib g_base64_encode()Red Hat Enterprise Linux
- CVE-2025-12387Denial of Service in Pix-Link LV-WR21QPix-Link LV-WR21Q · Pix-Link WR21Q
- CVE-2025-12386Missing Authentication for Critical Endpoint in Pix-Link LV-WR21QPix-Link LV-WR21Q · Pix-Link WR21Q
- CVE-2025-41728Beckhoff: Information leak via Beckhoff Device ManagerBeckhoff Automation Beckhoff.Device.Manager.XAR · Beckho… +1
- CVE-2026-24347Arbitrary file write to /tmp directory in EZCast Pro II DongleEZCast Pro II
- CVE-2026-1467Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configuredRed Hat Enterprise Linux
- CVE-2026-24829Out-of-bounds write in is-EngineIs-Daouda is-Engine
- CVE-2026-24345Cross-Site Request Forgery in EZCast Pro II DongleEZCast Pro II
- CVE-2026-24825a memory leak in ydb-platform/ydb with use of yajl_tree_parse function from src/yail module, which will cause out-of-memory in server and cause crash.ydb-platform ydb
- CVE-2026-24824A XSS in yacy/yacy_search_serveryacy_search_server
- CVE-2026-24820A stack overflow vulnerability in turanszkij/WickedEngineturanszkij WickedEngine
- CVE-2026-24819An out-of-memory (OOM) issue in foxinmy/weixin4jfoxinmy weixin4j · com.foxinmy:weixin4j-base
- CVE-2026-24818A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in praydog/UEVRpraydog UEVR
- CVE-2026-24809Save stack space while handling errors in praydog/REFrameworkpraydog REFramework
- CVE-2026-24807Buffer Overflow Vulnerability in liuyueyi/quick-medialiuyueyi quick-media · com.github.liuyueyi.media:batik-code…
- CVE-2026-24806Buffer Write Security Vulnerability in liuyueyi/quick-medialiuyueyi quick-media · com.github.liuyueyi.media:batik-code…
- CVE-2026-24805Mishandles certain out-of-memory conditions in visualfc/liteide via liteidex/src/3rdparty/libvterm/src modulevisualfc liteide
- CVE-2026-24802Buffer Overflow Vulnerability in briandilley/jsonrpc4jbriandilley jsonrpc4j · com.github.briandilley.jsonrpc4j:js…
- CVE-2026-24801A Potential SPA-vulnerability in Ralim/IronOSRalim IronOS
- CVE-2026-24799A heap-based buffer over-read or buffer overflow in davisking/dlibdavisking dlib
- CVE-2026-24797An out of bounds write due to a missing bounds check in neka-nat/cupochneka-nat cupoch
- CVE-2026-24795An Out-of-bounds Write in CloverHackyColor/CloverBootloaderCloverHackyColor CloverBootloader
- CVE-2026-24796A Out-of-bounds Read vulnerability in CloverHackyColor/CloverBootloaderCloverHackyColor CloverBootloader
- CVE-2026-1464A possible integer overflow vulnerability in RawTherapee/RawTherapeeMuntashirAkon AppManager
- CVE-2025-14971Link Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellationlinknacional Link Invoice Payment for WooCommerce
- CVE-2026-24686go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Namestheupdateframework go-tuf · github.com/theupdateframework/g…
- CVE-2026-24489Gakido vulnerable to HTTP Header Injection (CRLF Injection)HappyHackingSpace gakido · gakido
- CVE-2026-23683Missing Authorization check in SAP Fiori App (Intercompany Balance Reconciliation)SAP_SE SAP Fiori App
- CVE-2025-28162Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSani
- CVE-2025-28164Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() func
- CVE-2025-65264The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attack