2026

A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file

A security flaw has been discovered in MyScale MyScaleDB up to 1.8.0. This vulnerability affects the function SegmentId:

A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7. This affects the function sha256 of the file src/mai

A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpo

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Pytho

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token

Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; ver

LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can se

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b0

An improper access check allows users to display a list of modules in the frontend.

n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to f

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart opera

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authoriz

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform aut

The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinj

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classe

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) with

OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature t

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or c

A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spaw

A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottl

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir

In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_stack`) lacks proper

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Suppor

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations).

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reportin

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Po

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and

A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functio

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.

Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had comprom

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the serve

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality.

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin fail

A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file

In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assign

A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remote attacker

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research