2026

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public no

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker cou

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Se

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NS

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression poi

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Pri

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenti

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoint

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an aut

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authen

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes atta

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaus

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC mes

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 conta

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/ht

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. In

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, s

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This aff

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file ap

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivi

Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows una

A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustain

A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Serv

A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modif

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insu

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID}

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker w

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listen

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEnt

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/pro

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemet

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's ssh_fil

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior