2026

Intego Log Reporter, a macOS diagnostic utility bundled with Intego security products that collects system and applicati

Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enu

ntpd-rs is a full-featured implementation of the Network Time Protocol. Prior to 1.7.1, an attacker can remotely induce

FastGPT is an AI Agent building platform. Due to the fact that FastGPT's web page acquisition nodes, HTTP nodes, etc. ne

Scraparr is a Prometheus Exporter for various components of the *arr Suite. From 3.0.0-beta to before 3.0.2, when the Re

emp3r0r is a stealth-focused C2 designed by Linux users for Linux environments. Prior to 3.21.1, untrusted agent metadat

Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in

Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in

grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because

Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maxim

lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field is

A flaw was found in Dropbear. When running in multi-user mode and authenticating users, the dropbear ssh server does the

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut

navigation2 is a ROS 2 Navigation Framework and System. In 1.3.11 and earlier, a critical heap out-of-bounds write vulne

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Li

A reachable infinite loop via an integer wraparound is present in Silicon Labs' Matter SDK which allows an attacker to t

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managi

Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in t

authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source tha

LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadat

LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymak

authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible

authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using de

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly han

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSIO

Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kuberne

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable

A heap buffer overflow in the processRequest function of Open TFTP Server MultiThreaded v1.7 allows attackers to cause a

A stack overflow in the ZBarcode_Encode function of Monkeybread Software MBS DynaPDF Plugin v21.3.1.1 allows attackers t

thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating

TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the

Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to p

Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executa

NextVPN 4.10 contains an insecure file permissions vulnerability that allows local users to modify executable files with

newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not inco

newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisi

mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vul

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memo

webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of s

webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive

CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds p

p2r3 Bareiron commit: 8e4d4020d is vulnerable to Buffer Overflow, which allows unauthenticated remote attackers to cause

p2r3 bareiron commit: 8e4d4020d contains an Out-of-bounds Read, which allows unauthenticated remote attackers to get rel

An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute arbitrary code via the

A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resul

Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and

Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously cr

Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Gl