2026

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attack

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows

FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject

CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article arc

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site a

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath tha

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbi

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attacke

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authentic

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated auth

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated works

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify

PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated stu

SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attack

IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing init

IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryp

Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on

Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might al

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclo

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRT

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain

Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domai

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handlin

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding ag

PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules.

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, lo

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, pa

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded syste

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded syste

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded syste

Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrar

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAF

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/s