2026

Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to

Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security no

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-valid

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, ar

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-d

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssF

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call Template

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can a

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connecti

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store atta

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling ca

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources le

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetD

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploadin

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body t

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the aut

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/user

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/o

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publicatio

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js a

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/r

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than in

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed

Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extensio

A local privilege escalation vulnerability in ESET Inspect Connector.  The vulnerability was caused by improper authenti

Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the syste

Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malici

stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching me

stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed

Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Pro

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/worksp

An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard

Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core T

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration fo

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin g

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.lang

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientCl

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vul

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a sound

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the dec

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword p