2026

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0

A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality o

A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the fil

In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not vali

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering

Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-im

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar arch

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. v

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program w

MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_i

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused acr

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attacke

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task'

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails t

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settin

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enu

Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial o

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing auth

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce a

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endp

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deepl

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL functi

AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirecti

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values fr

FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allow

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway t

FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbo

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function tha

FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits

FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fail

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pool_decode_rect function when decoding

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_curr

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsig

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU

FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to v

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the for

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns u

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_di

A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /in

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/query

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with