2026

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive con

PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before ver

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before vers

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc emb

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code exec

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulner

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulner

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a comm

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a comm

Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit

A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the

A vulnerability has been found in eladmin up to 2.7. Impacted is the function checkLevel of the file /rest/UserControlle

A flaw has been found in SourceCodester Comment System 1.0. This issue affects some unknown processing of the file post_

An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver se

An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause s

A vulnerability was detected in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the fil

A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file sr

A vulnerability was determined in Open5GS up to 2.7.7. This impacts the function ogs_sbi_discovery_option_add_snssais in

A vulnerability was found in Open5GS up to 2.7.7. This affects the function ogs_sbi_discovery_option_add_service_names i

A vulnerability has been found in Open5GS up to 2.7.7. The impacted element is the function ogs_sbi_parse_plmn_list in t

A flaw has been found in Open5GS up to 2.7.7. The affected element is the function nssf_nnrf_nsselection_handle_get_from

A vulnerability was detected in Open5GS up to 2.7.7. Impacted is the function ogs_sbi_stream_find_by_id in the library /

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects some unkno

A weakness has been identified in huangjunsen0406 xiaozhi-mcphub up to 1.0.3. This vulnerability affects unknown code of

A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the fil

This vulnerability, in the MAXHUB Pivot client application versions prior to v1.36.2, may allow an attacker to obtain e

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0

A vulnerability was identified in JeecgBoot up to 3.9.1. Affected by this issue is some unknown functionality of the fil

A vulnerability was determined in 8421bit MiniClaw up to 43905b934cf76489ab28e4d17da28ee97970f91f. Affected by this vuln

A vulnerability was found in 8421bit MiniClaw up to 223c16a1088e138838dcbd18cd65a37c35ac5a84. Affected is the function e

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page th

A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that a

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attack

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose i

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor previ

Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated

Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges ove

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. Th

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This un

Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges

Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unaut

Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attac

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code ove

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) all

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code ove

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthoriz