2026

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClie

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `Add

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request for

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP re

OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages

matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix cli

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticat

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A us

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's vali

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to me

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` p

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click st

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mous

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulner

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, custom

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoin

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missin

matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matri

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transit

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffe

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't ex

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing_

In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mism

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold exec_update_lock around namespace ioctl

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_t

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_labe

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null termina

In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task s

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing f

In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable foli

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in mi

In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freein

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_p

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shr

In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a limit update is supe

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handl

In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state bef

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to kthread_stop(

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read on s