2026

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/ema

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts f

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praison

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_block

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_se

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime asse

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the ini

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corrupti

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotio

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Re

The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuth

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-base

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer ove

novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that all

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endp

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks prop

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is

A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the fil

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/comp

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting

Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenti

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and retu

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the

Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, whi

Description The DRPC server kept a map from function name to request queue and created an entry the first time a functi

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows aut

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconc

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is config

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user ac

LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/p

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated cus

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authent

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints t

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allow

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. C

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reappl

File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (res

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads e

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permission

A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of t

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the f