2026

Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Wei

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the defaul

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that

Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in applica

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that al

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToFo

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can contin

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, Adonis

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() at

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin tru

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import function

Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user

Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An auth

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenti

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cr

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authe

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cro

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attac

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management int

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce auth

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows au

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that r

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior t

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON cont

IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API

Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.ph

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 migh

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior t

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior t

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior t

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeS

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecog

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacke

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size lim

An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).

IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the Wfp

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncs