2026

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage ma

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user ca

An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Ba

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiyin

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiyin

A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could

A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user ca

A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local pr

A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could all

An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master.

An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benk

Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers t

A weakness has been identified in OpenBMB XAgent 1.0.0. Affected by this vulnerability is the function workspace of the

A security flaw has been discovered in LockerProject Locker 0.0.0/0.0.1/0.1.0. Affected is the function authIsAwesome of

A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file lib

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

PingPong is a platform for using large language models (LLMs) for teaching and learning. Prior to 7.27.2, an authenticat

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vul

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted S

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-brac

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelbla

xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credenti

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint (P

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unb

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded r

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Serv

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only l

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if Himmelbl

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lac

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action suppo

WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, a critical SQL injection vulnerability exist

WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, WeGIA (Web gerenciador para instituições ass

WeGIA is a web manager for charitable institutions. In 3.6.5, The patched loadBackupDB() extracts tar.gz archives to a t

Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT)

Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vu

Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Privilege Management vulnerabilit

Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Certificate Validation vulnerabil

A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the fil

Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/acc

Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for una

Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin

Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation

Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a

Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a ce

Notesnook is a note-taking app focused on user privacy & ease of use. Prior to 3.3.9, a Stored Cross-Site Scripting (XSS