2026

Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Laun

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (f

elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results i

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Fina

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Fina

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21,

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking applic

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1812, the listing ta

nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the ema

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 20

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 20

Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extens

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created MCP (Model

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoi

LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side

LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth

A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the

A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function

Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software

Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap

Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirm

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` met

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_file` and `get_ap

Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host

Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoint

Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic c

Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k

A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /ad

A vulnerability was detected in letta-ai letta 0.16.4. This issue affects the function resolve_type of the file letta/fu

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `p

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `categories.json.php` endpoint,

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in in the v

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to ex

A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function _convert_me

A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evalu

A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in t

A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex o

A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/W

Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticat

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `verifyTokenSocket()` function i

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` e

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/PlayLists/View/Playlists

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to pass

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTitle()` static method

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike(

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file