2026

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuratio

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the fi

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Fi

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can del

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the prin

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parame

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificat

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permiss

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session u

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation ac

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team admi

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread,

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to acce

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts an

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme transla

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, su

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, s

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing

A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the fi

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a spec

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Conf

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Contr

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerc

In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payloa

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to i

In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This coul

In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lea

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessi

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were store

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is r

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control S

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This iss

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Co

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations R

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows