2026

Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@pa

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafte

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 1

Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is ena

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly va

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Se

Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Se

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked.

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp

Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variabl

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1

The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) po

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does no

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API e

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implem

The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to,

** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dyn

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount with username option C

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload l

Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak ps

prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability in skill file handling that allows attacker

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive an

Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior t

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is

Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.Th

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based bli

Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferr

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (

An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially

An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A s

A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A spec

An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved. This is

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Rec

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec