2026

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-bet

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_autho

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_right

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.ph

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php ac

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_page

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1,

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo

Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, m

A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of t

Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73c

IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity in

Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Cr

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload compon

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticat

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2_tree_c

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pme

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed S

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the messag

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported p

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipie

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipi

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionalit

IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files,

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could ex

IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent fo

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from

The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS)

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as val

The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported fro

The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS).

The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 t