2026

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the Over

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated u

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentiall

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated us

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable fil

Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments t

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary l

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compres

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted req

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth a

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow a

A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authe

In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered h

An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to versio

Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecomm

External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 20

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier allow

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server  2026.3.10.0 and earlie

Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.

An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacke

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multip

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, w

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 bef

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentiall

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive informa

In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing c

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially le

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condi

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass aut

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivate

crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Im

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a

A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parame

A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a2

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s pu

Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allo

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authe