2026

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Loca

A vulnerability in MISP’s non-REST event editing path allowed an authenticated user with event edit permissions to manip

An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs du

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inse

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisa

A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint pre

An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply re

Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote d

ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyU

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker to trigger a segmentation fault leading to a denial of servi

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password r

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authen

ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vuln

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements all

A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of t

A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by this issue is some unknown

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegatio

A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the

MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. W

An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accou

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability ex

Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forger

AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a

Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via th

Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path

Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty term

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the

Actual is a local-first personal finance tool. The `POST /openid/config` endpoint in Actual Budget's sync-server version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.