2026

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to th

A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Plug

A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser,

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function o

A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file sce

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/

A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegr

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending spec

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider with

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use a

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-cont

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token acc

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddlewar

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signa

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controll

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-cre

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a r

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.p

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for M

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered w

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocato

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats r

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the f

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_not

A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown funct

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP com

Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For

Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline a

Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payl

Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level author

Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalanc

Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty

Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the ent

Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking

Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from t

Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervi

Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a serv

TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows u

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProdu

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to pot