2026

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatMo

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter

Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects

A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44. Affected is an u

The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1

A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /

A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the

A vulnerability was identified in Page-Replica Page Replica up to e4a7f52e75093ee318b4d5a9a9db6751050d2ad0. The impacted

A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /gof

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated att

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated att

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. P

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.39.0, the cpp-httplib HTTP

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypas

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter fram

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Z

dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI ins

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.

Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a h

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. I

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attack

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in

A vulnerability was found in Tenda AC5 15.03.06.47. Impacted is the function formWifiWpsOOB of the file /goform/WifiWpsO

A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/

Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to system

Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui

Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulner

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to versio

A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /gofo

A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addr

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or

Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket bac

Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API reli

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fing

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the fil

A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unk

A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected by this vulnerability is an un

The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of

A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal v

Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.