2026

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message

A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PC

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe

A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the c

A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to de

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish r

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyu

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authentica

A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.deskto

Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On m

Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cac

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destr

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calli

The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource pa

ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte trans

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size fi

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size fi

The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in j

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key i

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because l

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected becau

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because red

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affect

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem fa

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when pro

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_k

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affecte

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of

A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.cre

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the f

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callre

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Us

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is respons

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json