2026

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollm

Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to i

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST A

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace

Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did n

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM managem

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22

Improper Control of Generation of Code ('Code Injection') vulnerability in Yordam Information Technology Consulting, Tra

Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Indus

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execut

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClien

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPip

Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies wer

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated,

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/f

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine th

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Got

DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI se

MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Fo

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly

Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack

Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebA

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP se

OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace del

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base:

Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as th

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lsee

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitra

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite loca

Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to un

Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and

The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up

Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc. Yaay Social Med

The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion i

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP reques