2026

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Serv

WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded

CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy s

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters usi

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Ar

CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers

CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledg

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io aut

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a Data Rea

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/p

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allo

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a

Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provide

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can

Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. An attacker with ph

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26

Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sen

SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Docum

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggere

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a u

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's /icons/{domain}/icon.png en

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirl

The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files ou

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist wh

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow acc

When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with per

Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's a

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.

DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availabilit

Design defect vulnerability in Expedition mode. Impact: Successful exploitation of this vulnerability may affect availab

Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affe

Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect ava

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affec

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may af

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may af

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may af

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may af

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may af

A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directo

Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detec

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where

Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members