2026

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet pres

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5,

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4,

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attac

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to sto

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multip

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRo

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/pa

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated user

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execu

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXE

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with t

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access b

luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated user

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/cro

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default Cr

AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adj

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This atta

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has b

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitr

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affect

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected el

A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown func

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in th

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers

A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Stor

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management mod

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator f

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper val