2026

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-r

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method,

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbi

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to re

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthentica

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_tex

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote

libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vaul

A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subty

A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can c

A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from

A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side fie

The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two client

The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter ide

The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in Find

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an appli

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an unders

The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handl

The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON me

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msg

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3

Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not REA

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissi

A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascri

An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to lo

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-auth

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.c

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when i

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workfl

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST

Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <us

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attac

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted s

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compres

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Read

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorr

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the pars