2026

Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to cra

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted,

A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file

A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated f

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, staff can

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `ip_a

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a pote

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authori

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport t

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a

flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled s

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and pr

Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload ha

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a fo

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site script

SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can per

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts una

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/ut

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to versio

Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c

Halloy is an IRC application written in Rust. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, the DCC receive

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

Requires malware code to misuse the DDK kernel module IOCTL interface. Such code can use the interface in an unsupporte

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-

A vulnerability was determined in Mindinventory MindSQL up to 0.2.1. The affected element is the function ask_db of the

A vulnerability was found in Mindinventory MindSQL up to 0.2.1. Impacted is the function ask_db of the file mindsql/core

The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 v

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileg

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticate

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator p

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applicati

ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content bein

A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated r

libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream ca

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL u

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading