2026

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java ap

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Info

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aida Comput

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.4, 18.7 before 18.7.2, and 1

MeetingHub developed by HAMASTAR Technology has an Arbitrary File Upload vulnerability, allowing unauthenticated remote

MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote at

Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actual

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versio

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46

pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/sla

Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly acces

Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, al

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function atte

Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished j

Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exis

Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scri

Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versi

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formu

jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a com

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if th

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature mal

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key r

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature for

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18,

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18,

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, a

CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to sus

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attac

A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and belo

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that on

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to sym

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic f

Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capa

Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vuln

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modificati

Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default impl

Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functio

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilit