2026

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability.

A vulnerability was identified in projectworlds Lawyer Management System 1.0. This issue affects some unknown processing

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, improper escaping of tag names retriev

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php),

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in ver

MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that

MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that

MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to versio

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family database

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing

The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior

A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in

A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and ea

A vulnerability was determined in code-projects Exam Form Submission 1.0. This vulnerability affects unknown code of the

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Subscribe::save()` method in `o

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()`

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control e

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `getRealIpAddr()` function in `o

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at `o

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/AD_Server/reports.json.p

WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations f

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint pas

WWBN AVideo is an open source video platform. In versions up to and including 26.0, a user with the "Videos Moderator" p

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermissio

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `ImageGallery::saveFile()` metho

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`AP

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptStr

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions

strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allo

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are autom

A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitiz

A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy

A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables

Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoin

A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the f

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php`

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side reque

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/Vie

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fix for CVE-2026-27568 (GHSA-rcq

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `vi

XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file

XnSoft NConvert 7.230 is vulnerable to Stack Buffer Overrun via a crafted .tiff file.

A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows atta