2026

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functiona

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any t

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critic

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below th

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to befor

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtain

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.val

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer S

Tanium addressed a denial of service vulnerability in Tanium Client.

A security flaw has been discovered in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /gofo

A vulnerability was identified in Open5GS up to 2.7.6. This affects the function sgwc_s5c_handle_modify_bearer_response/

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUX

client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Vers

MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration. Prior to 0.

Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and e

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and e

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and e

Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profil

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Rev

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an au

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQ

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a cri

A vulnerability was determined in D-Link DIR-823X 250416. Affected by this issue is the function sub_424D20 of the file

A vulnerability was found in code-projects Simple Blood Donor Management System 1.0. Affected by this vulnerability is a

Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to p

Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configu

Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using p

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory change

OrcaStatLLM Researcher is an LLM Based Research Paper Generator. A Stored Cross-Site Scripting (XSS) vulnerability was d

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Z

OpenProject is an open-source, web-based project management software. Prior to 17.0.2, the drag&drop handler moving an a

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and e

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in th

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via p

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/conte

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attac

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xerox Centr

Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not

Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, da

A vulnerability has been found in SourceCodester Medical Center Portal Management System 1.0. Affected is an unknown fun

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This im

MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an e

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1