2026

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and be

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulnerability in

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnerability in

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mecha

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypa

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due t

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could m

Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft

Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacke

jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-539

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus a

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability whe

SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript pa

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authe

Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker

Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Structures), an attacker

Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Reference Equipment), an attacker could upd

Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Structures), an attacker c

SAP Landscape Transformation contains a vulnerability in an RFC-exposed function module that could allow a high privileg

Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated att

Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete

The Material Master application does not enforce authorization checks for authenticated users when executing reports, re

Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthent

Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catal

The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5

Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuff

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() AP

jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its ar

A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function

A vulnerability was identified in HummerRisk up to 1.5.0. This vulnerability affects the function ServerService.addServe

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain b

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 a

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below both 7.1.2

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sor

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain U

An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable S

A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access t

A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device