2026

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish tem

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById han

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any accou

A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function

A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /

AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obt

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attack

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the fiel

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to f

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote una

Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied a

Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configu

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppK

UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user t

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-pri

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated at

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load maliciou

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that veri

CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to lis

A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channe

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0

mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shel

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauth

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-r

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-

Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated att

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which s

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite ano

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust P

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket

Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members

Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that igno

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web ses

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pb

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that le

Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra b

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that

OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unaut

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tok

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attack