2026

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 t

Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command

This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the manage

This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed logi

This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-b

Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.

Privilege escalation in the Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thund

Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunder

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not appl

In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict

This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.

Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in l

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer ov

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-ba

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials thr

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enab

An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to byp

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `r

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERY_INFO for compound req

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix read abandonment during retry Under cer

In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_ino

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro,

A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @papercl

TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent al

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remo

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignme

OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execu

OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perfor

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /co

Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role)

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, A

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix the descriptor address in __kvm_at_

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more r

In the Linux kernel, the following vulnerability has been resolved: can: gw: fix OOB heap access in cgw_csum_crc8_rel()

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hol

In the Linux kernel, the following vulnerability has been resolved: NFC: digital: Bounds check NFC-A cascade depth in S

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED che

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed e

Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in

SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, SiYuan desktop renders notification messa

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Pr

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's c

A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the f

A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file

A weakness has been identified in Tenda F456 1.0.0.5. The impacted element is the function fromaddressNat of the file /g