2026

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/c

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.ano

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChec

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transf

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error repor

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34,

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Sta

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19

The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses afte

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. Whe

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 exten

CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /c

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the

ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated custome

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume si

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrar

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed

When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running o

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traver

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote att

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote at

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to i

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticate

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote at

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executab

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allow

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module r

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals

In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reasse

In the Linux kernel, the following vulnerability has been resolved: mtd: virt_concat: fix use-after-free in mtd_virt_co

In the Linux kernel, the following vulnerability has been resolved: mtd: virt_concat: fix use-after-free in mtd_virt_co

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix root leak if its reloc root is unexpecte

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on core-sched forced idle in

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound p

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent rereg_mr for non-mem regions W

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_crea

In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARN_ON in add_mtd_device(

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on u

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100