2026

The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `s

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes

The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including

The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by th

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate t

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to f

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing t

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload an

The Flipbox Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flipbox widget

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via exter

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authen

Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all

The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkin_place_id' parameter in al

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (Memo

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenti

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 (Jump

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the Se

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) rende

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint va

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (S

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/pu

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functional

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation com

ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::ge

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoin

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenti

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenti

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerabi

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_u

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulner

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `pt

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the

The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A given

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `pt

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exi

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2

Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, Hot Chocolate's