2026

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ap

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, th

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allow

Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote att

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied i

Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitra

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail

Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that all

When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airf

Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enable

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/adm

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_v

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allow

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration

A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Locat

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server tha

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown fun

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /ro

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment not

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before renderi

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side w

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of t

A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /Sc

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue oc

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solu

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impa

nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias()

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/sit

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extension

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/l

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file u

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file ge

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug

A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulne

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_

A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function render_slides of the file packages/cli

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of th

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function impor

A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function get_file_sni

A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_d

A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderActi

A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affe

A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the