2026

Hirschmann HiLCOS products OpenBAT, BAT450, WLC, BAT867 contains a firewall filtering vulnerability that fails to correc

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an o

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to ver

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Templ

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability w

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability e

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API meth

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vuln

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interfac

Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior t

Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical

OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux

Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow

Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC drive

Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0

Out-of-bounds write in the query processing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat

Improper neutralization of special elements in the authentication components in Amazon Athena ODBC driver before 2.1.0.0

OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it thr

Development and test API endpoints are present that mirror production functionality.

A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

A specific administrative endpoint notifications is accessible without proper authentication.

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arb

Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool.

A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API cal

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive an

prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status pol

prompts.chat prior to commit 7b81836 contains multiple authorization bypass vulnerabilities due to missing isPrivate che

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media genera

prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability in skill file handling that allows attacker

Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end u

Hirschmann Industrial HiVision version 08.1.03 prior to 08.1.04 and 08.2.00 contains a vulnerability in the execution of

Hirschmann HiOS devices versions prior to 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet

Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in

A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a

Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak ps

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h`

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Ha

A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFE_TBL_ValidateCodecLoadSize

A vulnerability was determined in NASA cFS up to 7.0.0. This impacts the function CFE_SB_TransmitMsg of the file cfe_sb_

Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a networ