2026

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeS

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecog

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacke

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size lim

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affect

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerabi

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerabi

An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).

Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to by

IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the Wfp

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper c

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthen

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 ce

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlock

The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identi

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype b

dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScrip

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system c

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncs

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacke

amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advi

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic w

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs c

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Lat

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instea

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible typ

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that ter

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credenti

Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. Th

Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read retur

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can r

Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid exten

Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid use

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another pro

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the mainten

In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess()