2026

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In ve

Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compou

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissi

Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists

FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF

FastGPT is an AI Agent building platform. Prior to version 4.14.17, FastGPT had an inconsistent SSRF protection gap in M

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who c

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in

Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical v

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Ka

Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added i

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packa

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packa

FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insuffi

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.1

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists

FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Pu

SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoin

ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allow

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnera

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to versio

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and u

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin func

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with reta

Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulne

nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-

Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accep

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (X

Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows at

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension typ

MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile

SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsd

Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerabili

People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0,