2026

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separ

Mattermost Plugins versions <=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows a

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restric

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate decompres

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced

Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to co

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-cont

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an aut

Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStr

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Versions st

Briefcase is a tool for converting a Python project into a standalone native application. Starting in version 0.3.0 and

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

Sakai is a Collaboration and Learning Environment (CLE). In versions 23.0 through 23.4 and 25.0 through 25.1, group titl

EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop

EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorizat

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (potential memo

OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitra

Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (

EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_tra

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_session_setup cop

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phas

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-free. This i

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::map<std

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::queue`/

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to th

The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-ne

Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.

Buffer Overflow vulnerability in ZerBea hcxpcapngtool v. 7.0.1-43-g2ee308e allows a local attacker to obtain sensitive i

A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to

A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), SICORE Base syst

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map<std::optiona

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::string` concurre

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map<std::optiona

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vector) that le

EVerest is an EV charging software stack. Prior to version 2026.02.0, stack-based buffer overflow in CAN interface initi

EVerest is an EV charging software stack. Prior to version 2026.02.0, `HomeplugMessage::setup_payload` trusts `len` afte

EVerest is an EV charging software stack. Prior to version 2026.02.0, an off-by-one check in IsoMux certificate filename

A security flaw has been discovered in itsourcecode Payroll Management System up to 1.0. This affects an unknown functio

A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown fun