2026

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team membe

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authen

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentic

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override exec

Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file acc

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback en

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset e

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authen

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lac

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middl

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission check

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating un

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing una

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry pat

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint th

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remot

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can in

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attack

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cg

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer deref

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comme

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its genera

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutr

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML.

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .verv

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabiliti

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in th

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cg

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cg

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cg

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized

Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to per

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoo

Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attac

Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over

Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft E

SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows a

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0,

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandEx

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-defi

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control