2026

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in

FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol

FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTS

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause den

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribut

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-con

webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser perf

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice arc

Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Doc

The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard

Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex mat

Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompress

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restri

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based acc

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice arc

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte len

A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and e

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and g

A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding

An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authentica

An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authe

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/d

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively i

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the re

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths ha

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an i

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit i

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.1

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.1

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.

Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue a

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that a

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious M

An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal durin

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leav

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler th

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of liba

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.