2026

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0,

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.update

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message h

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enha

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enha

A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/de

A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2ht

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding sche

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset e

Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its au

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/ve

Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an a

Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash

Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A l

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TC

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by M

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN

Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_priv

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /m

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP d

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enha

Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-nativ

Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users

Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated use

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authen

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#c

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post review

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any m

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that

Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allow

Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary

FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/downloa

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth mo

bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view rest

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Te

A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality

A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of th

A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin o

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 befo