2026

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed password

Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to rede

A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execu

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker

A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin fail

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /ap

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the termi

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automatio

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline di

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolv

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legac

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the stand

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open Web

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1

GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions pri

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 micr

Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flow

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsan

SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated a

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality.

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that con

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager sing

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager sing

NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A s

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repos

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for sto

A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Cli

A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClassAttribute

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browse

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file ag

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field(

An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeome

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.

Information Disclosure when processing wireless network channel switch information with improperly formatted length fiel

Memory Corruption when processing registry values with incorrect types using a direct query method.

A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the U

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operat

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to in

A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affect

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log m

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS pr

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An an

Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153