2026

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formu

jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a com

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if th

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature mal

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key r

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature for

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18,

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18,

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, a

CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to sus

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attac

A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and belo

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that on

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to sym

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic f

Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capa

Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vuln

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modificati

Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default impl

Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functio

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilit

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-cha

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterpr

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code blo

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior t

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and belo

Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vuln

Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, i

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to versio

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0