2026

XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Priv

Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas:

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Pri

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet

Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue aff

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This

IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using com

IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about o

IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using spec

A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_

IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary c

IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not proper

IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able

IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip

IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the syste

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScr

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScr

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardc

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a byp

OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allow

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the a

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the a

OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacke

melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacke

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts

melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apol

Water-Melon Melon commit 9df9292 and below is vulnerable to Denial of Service. The HTTP component doesn't have any maxim

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing /

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1

A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerabil

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT)

GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.

GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can

GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can

n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerab

OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior,

OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior,

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, suc

n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allo

n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge no

n8n is an open source workflow automation platform. Prior to versions 1.123.12 and 2.4.0, when workflows process uploade