2026

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-s

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to a

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev developmen

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` developm

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, application

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-o

agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). Depending o

FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().

FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in super

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affec

vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Dep

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows at

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecu

In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.

MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attri

MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of even

MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint

MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP s

MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII obje

MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translat

MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview

ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, s

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows ca

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded respons

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code in

Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outs

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive informatio

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker le

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside

Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who h

Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary cod

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside

Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin d

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to m

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 1