2026

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attack

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document vi

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers

Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side request forgery vuln

llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filt

Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link withou

tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpo

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitr

Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthentica

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs tha

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that perform

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the esta

LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users t

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to

CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken o

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS adm

A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function creat

A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastro

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_us

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a fo

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client function

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.re

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to v

The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate b

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@ht

Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tH

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page e

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that fo

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth hand

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-se

SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-acces

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows reader

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows una

Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software I

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library ca

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip di

Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Secur

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can