2026

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. St

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the origina

An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Hori

Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafte

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafte

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow

Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenti

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.rea

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the f

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rej

Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB inte

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# D

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharco

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks t

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (u

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attac

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agen

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An una

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older Versions vulnerabilit

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high priv

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoin

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST AP

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebU

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI

import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.

Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorr

Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.

Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.

Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.

Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.

Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.

Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.

Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.