2026

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a rep

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote c

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server ad

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where en

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allow

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allo

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineo

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly sha

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper becau

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authen

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command th

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allo

FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to w

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete oth

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep rec

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allo

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers

Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerab

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authentica

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to acces

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allo

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode tr

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity

Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to creat

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delet

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authe

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other us

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change serv

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field val

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authen

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses pub

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictab

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slu

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing con

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, is

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outsid

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force S

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Contr

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-