2026

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JW

Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows auth

mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command ex

Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The devi

Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did n

Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inj

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM managem

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Con

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.

Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middlewa

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's

gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf's Reference S

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-contr

Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit sema

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulne

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows

Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers. From 2.4.0, t

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELE

Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to

Improper Control of Generation of Code ('Code Injection') vulnerability in Yordam Information Technology Consulting, Tra

Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Indus

A side-channel attack, which requires a physical presence to the TPM, can lead to extraction of an Elliptic Curve Diffie

CWE-601 URL redirection to untrusted site ('open redirect')

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execut

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClien

Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feed

Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoi

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPip

Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies wer

PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_ha

css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allo

Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated,

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, r

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, r

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fi

HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive

HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured

HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This m

HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic autho

HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. Th

HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. T

HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may