2026

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HM

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, he

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ca

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Ji

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, OA

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieva

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwo

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Py

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENS

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loadi

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading b

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without

A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewar

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versio

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation f

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM han

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecod

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side requ

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the re

webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decod

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request U

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate v

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement o

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A su

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded pa

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource co

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length o

A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unk

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_ven

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refu

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the in