2026

A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of d

A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cac

A vulnerability was determined in Tosei Online Store Management System ネット店舗管理システム 1.01. The affected element is an unkn

A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the c

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthent

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3,

A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of t

A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the fil

Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry P

OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Centra

Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()`

CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prio

File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview,

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypas

Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulner

MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and

A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the

A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulne

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file

SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted s

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripti

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password au

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version

A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql

A vulnerability was found in birkir prime up to 0.4.0.beta.0. The impacted element is an unknown function of the file /g

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.

HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ce

Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request

teklifolustur_app is a web-based PHP application that allows users to create, manage, and track quotes for their clients

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10

Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, a

Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, a

Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, a

Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and pr

A vulnerability has been found in birkir prime up to 0.4.0.beta.0. The affected element is an unknown function of the fi

A flaw has been found in birkir prime up to 0.4.0.beta.0. Impacted is an unknown function of the file /graphql of the co

Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to

HCL AION  version 2 is affected by a Weak Password Policy vulnerability. This can  allow the use of easily guessable pas

HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical detail

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leav

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursor

HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized co

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbDa

OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users,

OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and

OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a s

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer over