2026

SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architectu

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in

Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint (PATC

monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoi

Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml() function in Ki

The Pz-LinkCard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blogcard' shortcode attribute

miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior co

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior co

graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares per

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in Abs

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to N

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScri

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new in

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (c

The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 hav

libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in

radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCoo

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template en

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style

next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.

OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is co

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in da

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultG

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 thro

Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide defaul

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynam

mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the

xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentic

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to

xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary comma

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versio

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH),

Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an at

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the exte

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and execute

Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary comm

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted,

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_

Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be retrieved without authentication,

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_

Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and ses