2026

MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage obje

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated user

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users

B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to rea

Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext pa

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables T

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime a

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify

Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password t

A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Direc

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Confi

Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integratio

Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploit

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file

A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the

A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the funct

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/a

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitiv

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a r

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote u

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authent

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a re

A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to creat

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, suc

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts,

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.1

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrit

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area af

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc

For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 ->

XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involv

The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations o

During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes m

An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-bet

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an a

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protoco

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readL

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKC

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's Rev

A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file in

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function A