2026

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Employee Snapsho

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t

Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 23.4.0-

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a

Vulnerability in the Oracle Life Sciences Empirica Signal product of Oracle Life Science Applications (component: Common

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enab

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a special

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) c

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root execut

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint `plugin/Live/view/Live_restreams/

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authentica

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authent

Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials thr

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forger

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network version 5.0.1, when dese

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends man

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-ba

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user das

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administr

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quaranti

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin da

mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-or

Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the r

Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vu

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges o

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

Parsing a malicious font file can cause excessive memory allocation.

A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of th

A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Hand

Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that all

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall serv

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerabili

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer ov

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing fu

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTok

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the mailbox OAuth disconnect act

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust