2026

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability i

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implem

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, a

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity()

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/ses

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated au

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API acce

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP ha

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, L

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) managem

Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02 contain an arbitrary code execution vul

Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remot

A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of th

A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of th

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API e

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to N

Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the H

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.5.3, the fix for CVE-2026-33645 was applied

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_ind

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does no

Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before t

The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prio

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data featur

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token

OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment varia

OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a malicious

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be ab

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonom

A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Son

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a malicious

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18

This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 1

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1. A malicious application may be

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious a

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be

A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able

HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authentic

A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionali

A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functional

A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file package

A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of t

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list i

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0,