2026

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/comm

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth an

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/vie

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/web

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/proje

Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows a

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87b

A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer

Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Stru

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is r

Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') v

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Bo

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro a

Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant R

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control S

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This iss

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Co

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo R

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations R

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limi

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data ra

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versio

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not ma

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This c

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Sli

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace mem

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownlo

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, includ

Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avata

A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61

A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/as

Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP address

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset witho

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() th