2026

Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.1

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.1

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on a

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator m

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From ve

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing

The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution thro

Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview ren

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behavi

Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal

Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDN

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS acce

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints.

An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to

Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create adm

OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL qu

eToolz 3.4.8.0 contains a denial of service vulnerability that allows local attackers to crash the application by supply

PlayJoom 0.10.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL q

ServerZilla 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database que

Nominas 0.27 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL quer

Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by

GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authent

Facturation System 1.0 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary

Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create admin

Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows u

Webiness Inventory 2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrar

Tina4 Stack 1.0.3 contains multiple vulnerabilities allowing unauthenticated attackers to access sensitive database file

Tina4 Stack 1.0.3 contains a cross-site request forgery vulnerability that allows attackers to modify admin user credent

Surreal ToDo 0.6.1.2 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitra

Silurus Classifieds Script 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute

Musicco 2.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary direct

Maitra 1.7.2 contains an sql injection vulnerability that allows authenticated attackers to execute arbitrary SQL querie