2026

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff

sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any ma

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that perform

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Atta

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the esta

LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, all

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users t

Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /

Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.up

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to

Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the c

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to ex

CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken o

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 1

Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanni

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information

Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This is

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS adm

A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function creat

A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vul

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastro

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.

(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the A

A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_us

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a fo

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client function

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TAC Information Se

snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allow

Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.re

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-chec

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /m

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET

Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter.

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to v

The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate b

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@ht