2026

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-cha

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterpr

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code blo

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior t

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and belo

Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vuln

Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, i

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to versio

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0

ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a

Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed

SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a mi

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in

EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes`

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has b

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminat

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol.

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An atta

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the

EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by

EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors

EVerest is an EV charging software stack. Prior to version 2025.12.0, `is_message_crc_correct` in the DZG_GSH01 powermet

D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When ex

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints.

Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticat

Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handl

Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the vlanId parameter, which can cause memor

Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder

OKI Print Job Accounting 4.4.10 contains an unquoted service path vulnerability in the OkiJaSvc service that allows loca

Pingzapper 2.3.1 contains an unquoted service path vulnerability in the PingzapperSvc service that allows local attacker

OKI Configuration Tool 1.6.53 contains an unquoted service path vulnerability in the OKI Local Port Manager service that

Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers

FreeLAN 2.2 contains an unquoted service path vulnerability in its Windows service configuration that allows local attac

Realtek Wireless LAN Utility 700.1631 contains an unquoted service path vulnerability that allows local users to potenti