2026

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated at

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that bac

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal t

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user app

Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run u

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origin

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders te

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attacker

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC hand

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated toke

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the Mongo

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entr

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enum

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php tha

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view sto

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows san

A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cg

A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of t

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSs

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unk

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthen

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attack

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escap

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map l

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute comma

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a ma

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack han

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer check

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza sil

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has

Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecre

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vul

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate val

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code executi

A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown p

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery:

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functi

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDe

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due t

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external si