2026

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to rea

Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_docume

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to o

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privile

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allo

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmode

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file i

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to vi

LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reac

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authoriz

Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows aut

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends cl

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exh

SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that

Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped

NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-data

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of th

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the compon

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_

A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the func

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli

A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Repl

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrd

A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file syst

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file temp

A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function

A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the com

A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allow

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload reques

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions,

The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installatio

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL qu

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL qu