2026

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the

NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed mem

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that

NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend

Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform

An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server

A vulnerability in the web application allows standard users to escalate their privileges to those of a super administra

nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its q

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could

Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the re

Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromi

Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in

Use after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbo

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software

An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with

Buffer overflow due to incorrect authorization in PLC FW

Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop version 3.3.15 and

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated a

Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a

Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the render

OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that expos

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes tha

Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP

URL redirection to untrusted site ('open redirect') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.

Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unaut

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior,

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before

PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (prais

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were publ

SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacke

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious in

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to

Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerabili

ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8

Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to

Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox

Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandb

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints.

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 15

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Fire