2026

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-suppli

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-priv

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configurat

Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. F

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Sto

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary f

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and wri

MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected X

novaGallery is a php image gallery. Prior to version 2.1.1, a path traversal vulnerability has been identified in novaGa

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simp

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restric

Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execut

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Z

Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service v

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows

Allocation of Resources Without Limits or Throttling vulnerability in absinthe-graphql absinthe allows unauthenticated d

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK regi

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for D

OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server

i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem

18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno

Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/ru

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (S

Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escal

lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson_stream.c). The end

An issue was discovered in kosma minmea 0.3.0. The minmea_scan functions format specifier copies NMEA field data to a ca

nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. When a client

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and p

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, t

In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix scheduling while atomic on PREEM

In the Linux kernel, the following vulnerability has been resolved: fs: init flags_valid before calling vfs_fileattr_ge

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Add NULL checks when resetting reques

In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs() handling There's an unpl

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix possible NULL pointer derefere

In the Linux kernel, the following vulnerability has been resolved: nfs: return EISDIR on nfs3_proc_create if d_alias i

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decrement re_receiving on the early exit

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix deadlock between devlink lock and esw

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix crash when moving to switchdev mode

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ reco

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for

In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fix missing error pointer check after r