2026

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in sale

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-r

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, B

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fa

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonica

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config f

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates o

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attacker

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerabi

CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool,

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to p

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy o

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of

Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim co

Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - A

Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct pat

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INIT

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/sr

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate

### Impact The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing a

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate reque

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate reques

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain request

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate t

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names c

MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consis

MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissio

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistentl

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status c