2026

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (c

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.rea

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the f

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowin

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rej

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intprot

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharse

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/cc

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cau

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can c

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can

Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB inte

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoD

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# D

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cau

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can c

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can c

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an arra

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can

In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharco

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks t

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconne

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arb

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd(

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authen

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privileg

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who contro

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to exe

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoin

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (u

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any au

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attac

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only ag

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agen

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allo

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode pro

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1