2026

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves upl

pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity de

Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UA

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, Mermaid diagrams are rendere

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttr

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttr

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server version

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER deco

Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie d

sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remot

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJA

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the han

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the han

free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the han

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transpor

mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRe

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame

Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingSer

Cryptomator is an open-source client-side encryption application for cloud storage. Version 1.19.1 contains a logic flaw

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocit

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC paramete

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands t

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with admi

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerab

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A hi

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hy

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

DataEase is an open source data visualization analysis tool. Versions 2.10.20 and below contain a SQL injection vulnerab

A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 a

The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-r

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or exceptional conditions vuln

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An unauthenticated attacker with ph

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 all

An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App:

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Malici

Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due

SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_e

SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_a

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_pa

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_lo