2026

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio tra

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuratio

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the fi

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attac

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Fi

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object I

Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The priv

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can del

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-upda

Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a fil

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Inj

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the prin

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plainte

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parame

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificat

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permiss

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session u

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlle

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation ac

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team admi

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread,

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature al

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to acce

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts an

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme transla

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme transla

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invite

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the re

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled websi

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded wit

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, su

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, s

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing

A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the fi