2026

FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores

FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerabi

BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation for

SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionalit

Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver befor

In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` cr

Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection throu

FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize dat

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appiu

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attac

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to r

Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite p

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automa

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certai

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions bel

A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/sn

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authe

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, descripti

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security featur

DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelet

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges ove

NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/op

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem

HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to

HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to impro

HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /t

HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-suppli

Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers

Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to ins

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an un

Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an auth

OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specific

An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information

An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addres

ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.

In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles protocol violations duri

Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any a

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate reque

Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set

An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive info

Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) pac

A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file

SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-lo