2026

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScri

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’

A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math

A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token

IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated us

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1

IBM Guardium Data Protection 12.1 is vulnerable to cross-site scripting. This vulnerability allows an administrative use

IBM Guardium Data Protection 12.1 is vulnerable to stored cross-site scripting. This vulnerability allows an administrat

IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the system. An attacker

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting i

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC end

A path Traversal vulnerability exists in Ziostation2 v2.9.8.7 and earlier. A remote unauthenticated attacker may get sen

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnera

The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the

In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability c

IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation, allowing unauthori

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access m

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user a

IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to m

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authe

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Sq

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulatin

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSR

Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `R

radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jell

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one K

Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generat

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses a

An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution wh

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0,

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0,

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template manag

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formu

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It

An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim ope

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStor

nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation. Prio

nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `VestingCon

Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `network-libp2p` disco

nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `MessageCodec::read_request` and