2026

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Valu

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Valu

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Valu

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/ge

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunke

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/

Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix,

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Valu

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM travers

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, a

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, an

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Valu

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Valu

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtde

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtde

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-ra

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the aut

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public

Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbit

A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied la

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/

The storage status-change REST service allows location records still associated with DICOM instances to be changed to de

An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a promp

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supply

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a reposit

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowin

Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to r

JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endp

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can

MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary c

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting acco

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-S

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, auth

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attac

Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user w

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authentica

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlie

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated u

An attacker can use a hard-coded credential to log in to EseeCloud devices.

The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexisten

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL c

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critica