2026

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline c

Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_row

Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 sele

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.ma

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in back

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Objec

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for im

A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory conte

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 al

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted

Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From

Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoi

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints fo

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in

Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a s

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: f

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services

Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that a

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache K

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, St

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, pa

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, ex

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, re

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40,

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly expos

JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manu

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() fu

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUM

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wra

IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to impro

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transacti

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-type

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS us

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exp

Integer overflow in OpenModSim (<=1.11.0), leading to denial of service

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Pr

A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to caus

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relyin

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A

Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privi

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to m