2026

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to res

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension

Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originate

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vu

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEv

ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with th

ChurchCRM is an open-source church management system. Prior to 7.1.0, the application is vulnerable to time-based SQL in

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in PropertyTy

ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in

ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerabili

ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting issue affects the Di

ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group remove control and fa

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the en

ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-suppl

ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS) vulnerabili

ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family re

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the en

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the en

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the en

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the en

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorre

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-a

ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was fou

ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the

ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting (XSS) vulnerability

ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting (Stored XSS) vulnera

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's back

ChurchCRM is an open-source church management system. Prior to 6.5.3, it is possible to trigger server-side HTTP/HTTPS r

MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The inser

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malfor

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malfor

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malfor

NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exp

NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disc

NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of output

OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inco

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allo

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client wit

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. In 5.2.5188 and earlier, a pre-authenticatio

PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry publish endpoint writes uploaded

PraisonAI is a multi-agent teams system. Prior to 1.5.113, The PraisonAI templates installation feature is vulnerable to

PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry pull flow extracts attacker-contr

PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vul