2026

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly res

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.1

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.1

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values wit

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-t

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword p

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_call

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on t

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling function

A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications

During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart

stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a

text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat

Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticate

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/sr

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the dec

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a sound

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handli

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in t

Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamica

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScrip

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server ac

rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf56d3, the Rust demangler in src/rust/rust_v0.c can

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores at

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Fl

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7,

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs a

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handl

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGrou

Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vul

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_p

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_

A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could al

A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market

A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrar

A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Manageme