2026

A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker c

A malicious SCP server can send unexpected paths that could make the client application override local files outside of

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9

`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branc

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the r

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with b

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traver

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API end

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-o

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU u

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can s

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format cod

A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup

Ruckus Unleashed contains a remote code execution vulnerability in the web-based management interface that allows authen

Ruckus Access Point products contain an arbitrary file read vulnerability in the command-line interface that allows auth

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that

A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where thi

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versio

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelat

Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.4, a stack-based

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php co

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitt

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via

A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attac

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

thingino-firmware versions up to the firmware-2026-03-16 release contains an unauthenticated os command injection vulner

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `F

Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the Li

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based o

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based o

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based o

H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `sta

goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in

Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulne

Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesys

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.

Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Pl