2026

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path

The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms.

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, L

LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed l

An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolve

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Boo

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTa

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qub

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Si

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jongmyoung Kim Kor

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chief Gnome Garden

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom

Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modif

Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path

OpenClaw before 2026.3.22 contains an improper authentication verification vulnerability in Google Chat app-url webhook

wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication tag length received a

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostna

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanis

OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies t

ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was a

UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability a

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.

Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Aj

A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution,

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/n

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5,

SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptograph

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFold

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conver

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supp

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supp

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leadin

A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondar

OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow

The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated si

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints t

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_c