2026

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for pre

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, r

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows auth

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allo

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticat

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows aut

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote

Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitte

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload fu

An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/

An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker t

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issu

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests co

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-cont

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2

The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-process

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redir

A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_14000

A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specia

idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.

CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of va

An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows

Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 lead

The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix functio

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/

An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses func

A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-funct

A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execut

A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under th

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox ho

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject con

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and aut