2026

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the ver

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows au

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers

YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated att

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a Z

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust b

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs sign

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedr

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-ha

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers b

Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcash

Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as dir

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticat

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clon

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to deg

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits hea

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptS

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading o

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scorin

Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 10

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows au

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff user

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untr

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including

Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Edi

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scr

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protec

SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn met

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, a

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot a

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affec

improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apach

Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability i

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects

Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. U

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache

Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability i

Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. T

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iter

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does no