2026

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-manage

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a craft

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted

DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply c

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fd

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Autho

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit data

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creat

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.9

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonic

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client d

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerab

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-wor

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applicati

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed whe

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on t

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated,

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, cau

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() p

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in r

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps PO

e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authenticati

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatical

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mob

Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Contro

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From versio

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4,