2026

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleContr

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler tha

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish tem

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById han

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any accou

A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function

A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the fiel

Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied a

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppK

UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user t

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated at

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load maliciou

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that veri

CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to lis

A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channe

mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shel

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-r

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-

Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated att

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite ano

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust P

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket

Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that le

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tok

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to rea

Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_docume

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to o

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privile

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allo

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmode

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file i

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to vi