2026

A security vulnerability has been detected in CodeAstro Food Ordering System 1.0. This affects an unknown function of th

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha

A flaw has been found in libvips up to 8.18.0. The affected element is the function vips_foreign_load_matrix_file_is_a/v

A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file lib

A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /

In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyn

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific da

GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCap

NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file a

Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Ph

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoin

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conver

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to,

The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and inclu

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-exi

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability

malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior

Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim'

Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentati

wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve priva

Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint return

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored i

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metada

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and m

Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0.

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow

The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on

SEPPmail Secure Email Gateway before version 15.0.1 does not properly verify that a PGP signature was generated by the e

SEPPmail Secure Email Gateway before version 15.0.1 does not properly communicate PGP signature verification results, le

SEPPmail Secure Email Gateway before version 15.0.1 improperly validates S/MIME certificates issued for email addresses

Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unau

Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() end

A vulnerability in the implementation of the proprietary SSH stack with SSH key-based authentication in Cisco Secure Fir

A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacke

A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive S

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handle

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffi

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params lik

Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privile

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a

OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure