2026

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthoriz

A security vulnerability has been detected in code-projects Feedback System 1.0. Impacted is an unknown function of the

A security flaw has been discovered in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the fi

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In ve

Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orche

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.

Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internat

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use

A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the

A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frm

manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assi

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum databa

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-

ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.

Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT sess

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds,

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute wit

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite functi

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribu

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp").

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sa

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it recei

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file f

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the f

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as e

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPyt

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_

GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitP

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFrom

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::san

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user hold

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-s

BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerabilit

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality

Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials ar

A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authen

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthen

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authentic

An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticat

An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unaut