2026

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have a

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server store

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbit

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to

The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path vali

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all

A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm al

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attacke

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any aut

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-o

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have tw

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an atta

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileg

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to caus

An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the se

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation

An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perfor

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authe

An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnost

An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an i

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the ser

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) proce

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to

An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to caus

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privil

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influenc

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag

An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request para

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is v

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in A