2026

A vulnerability was identified in dloebl CGIF up to 0.5.2. This vulnerability affects the function cgif_addframe of the

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include

Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL querie

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.hea

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the We

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in t

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-

LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP l

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby S

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 thro

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Hand

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafte

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a H

Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbi

UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP

A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWiFiGuestC

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow`

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@pa

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handleb

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolve

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Respo

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, the NetworkManager role was granted backup

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing a specially crafted

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticate

Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authentic

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:re

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace env

Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 ar

Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assis

A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcf

A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /gofor

A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknow

A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown fun

A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manip

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle UR

Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command process

Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow w