2026

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted

Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack o

Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerabil

Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to v

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to v

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToD

The WP Job Portal plugin for WordPress is vulnerable to SQL Injection via the 'radius' parameter in all versions up to,

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answe

Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1,

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In vers

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerabili

A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the fi

A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the fu

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cro

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call

OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authori

OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added

Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker

Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could st

Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibl

Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file direc

A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. Impacted is the function selectAll of the

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN,

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory ove

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creati

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an una

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an IDOR vulnerability where user.deta

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all use

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal

Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the fileName parameter is not filter

Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform perm

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an authenticated arbitrary file write