2026

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI help

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passpor

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-ty

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-rec

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of Apostrophe

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATC

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authen

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authen

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/pu

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-data

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to

Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows

A service account with user-management permissions in one organization can read, modify, disable or delete users belongi

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated p

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privil

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV co

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitim

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous

ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leak

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to up

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allo

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API e

A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of th

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget s

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages d

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The c

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one.

A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-by

The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memo

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask f

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much

A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one q

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` under

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts in

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger

`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the stri

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the