2026

An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that ex

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetchin

9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Wind

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Wind

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unpr

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /ca

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/rol

A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker

In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1

Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompresse

Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to writ

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter

PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE de

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFl

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attack

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaia

PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/ru

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/confi

PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks

In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling w

In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-tab

phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints

phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function

Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users

ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when me

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths

n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirec

Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate pro

Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding

Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user

Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-

Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attack

Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that rema

Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job

In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated atta