2026

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6

Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version

Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Script

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In vers

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report for

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-exi

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functional

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows upl

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerabil

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code i

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulne

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer o

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, an

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/p

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, an

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the `G

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulner

Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/c

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can stor

Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administra

A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-sc

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a cross-site request forgery vulnerability in its man

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication vulnerability that allows authentic

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a reflected cross-site scripting vulnerability in the

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability th

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 use the cryptographically broken MD5 hash function for sessio

Out-of-bound write vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administr

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication bypass vulnerability that allows re

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 transmit authentication credentials over unencrypted HTTP, al

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remot

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessag

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The han

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules),

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database q

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database q

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database q

Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attac

Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database querie

Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database querie

Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database querie

Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries

Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fas

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio