2026

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0

ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a

Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed

SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a mi

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in

EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes`

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has b

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminat

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol.

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths whi

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the

EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by

EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors

EVerest is an EV charging software stack. Prior to version 2025.12.0, `is_message_crc_correct` in the DZG_GSH01 powermet

D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When ex

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints.

Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticat

Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handl

Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the vlanId parameter, which can cause memor

Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder

OKI Print Job Accounting 4.4.10 contains an unquoted service path vulnerability in the OkiJaSvc service that allows loca

Pingzapper 2.3.1 contains an unquoted service path vulnerability in the PingzapperSvc service that allows local attacker

OKI Configuration Tool 1.6.53 contains an unquoted service path vulnerability in the OKI Local Port Manager service that

Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers

FreeLAN 2.2 contains an unquoted service path vulnerability in its Windows service configuration that allows local attac

Realtek Wireless LAN Utility 700.1631 contains an unquoted service path vulnerability that allows local users to potenti

eBeam Interactive Suite 3.6 contains an unquoted service path vulnerability in the eBeam Stylus Driver service that allo

eBeam Education Suite 2.5.0.9 contains an unquoted service path vulnerability in the eBeam Device Service that allows lo

GeoGebra Graphing Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the app

GeoGebra Classic 5.0.631.0-d contains a denial of service vulnerability in the input field that allows attackers to cras

GeoGebra CAS Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the applicat

VFS for Git 1.0.21014.1 contains an unquoted service path vulnerability in the GVFS.Service Windows service that allows

VestaCP versions prior to 0.9.8-25 contain a cross-site scripting vulnerability in the IP interface configuration that a

SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authen

Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write f

GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin at

Brother BRAdmin Professional 3.75 contains an unquoted service path vulnerability in the BRA_Scheduler service that allo

WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to

WIN-PACK PRO4.8 contains an unquoted service path vulnerability in the ScheduleService that allows local users to potent

WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to pote

ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating mult

OSAS Traverse Extension 11 contains an unquoted service path vulnerability in the TravExtensionHostSvc service running w

MacPaw Encrypto 1.0.1 contains an unquoted service path vulnerability in its Encrypto Service configuration that allows

Hi-Rez Studios 5.1.6.3 contains an unquoted service path vulnerability in the HiPatchService that allows local attackers

Event Log Explorer 4.9.3 contains an unquoted service path vulnerability that allows local users to potentially execute