2026

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-sup

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Cont

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate S

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed ex

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable pat

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characte

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a ta

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.2

Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking

Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no pack

Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer lengt

The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template ren

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerabilit

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported co

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions pri

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-clie

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation c

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspac

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API auth

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six to

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-se

llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore pa

llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path whe

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sample

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where