2026

Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the

Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access Control vulnerability. A l

SAPIDO RB-1732 V2.0.43 contains a remote command execution vulnerability that allows unauthenticated attackers to execut

Varient 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queri

R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the GUI Preferences language menu field that allows l

WinMPG iPod Convert 3.0 contains a buffer overflow vulnerability in the Register dialog that allows local attackers to c

Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local us

ARMBot contains an unrestricted file upload vulnerability in upload.php that allows unauthenticated attackers to upload

GetGo Download Manager 6.2.2.3300 contains a buffer overflow vulnerability that allows remote attackers to cause denial

RAR Password Recovery 1.80 contains a buffer overflow vulnerability that allows local attackers to crash the application

Outlook Password Recovery 2.10 contains a buffer overflow vulnerability that allows local attackers to crash the applica

SQL Server Password Changer 1.90 contains a buffer overflow vulnerability that allows local attackers to crash the appli

Easy MP3 Downloader 4.7.8.8 contains a buffer overflow vulnerability that allows local attackers to crash the applicatio

IntelBras Telefone IP TIP200 and 200 LITE contain an unauthenticated arbitrary file read vulnerability in the dumpConfig

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sen

eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal pr

Folder Lock 7.7.9 contains a buffer overflow vulnerability in the serial number registration field that allows local att

NetGain EM Plus 10.1.68 contains a remote code execution vulnerability that allows unauthenticated attackers to execute

Verypdf docPrint Pro 8.0 contains a structured exception handling buffer overflow vulnerability that allows local attack

Easy File Sharing Web Server 7.2 contains a local structured exception handling buffer overflow vulnerability that allow

Hisilicon HiIpcam V100R003 contains a directory traversal vulnerability that allows unauthenticated attackers to access

InputMapper 1.6.10 contains a buffer overflow vulnerability in the username field that allows local attackers to crash t

SpotIE Internet Explorer Password Recovery 2.9.5 contains a denial of service vulnerability in the registration key inpu

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability th

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib cl

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (I

flagd is a feature flag daemon with a Unix philosophy. Prior to 0.14.2, flagd exposes OFREP (/ofrep/v1/evaluate/...) and

Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API ca

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1

Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in

Craft is a content management system (CMS). The ElementSearchController::actionSearch() endpoint is missing the unset()

Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in t

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the

An information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to obta

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator t

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to

Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted i

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9

Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulner

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Striae is a firearms examiner's comparison companion. A high-severity integrity bypass vulnerability existed in Striae's

Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been i

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform