2026

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in o

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 un

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Refe

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:im

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and e

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or ma

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bun

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensit

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS)

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/inval

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation e

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py d

Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to

Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local

Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to exec

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authe

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shar

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipar

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substi

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_co

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_comman

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reco

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows u

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Inject

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authent

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that impl

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_da

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege att

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but

is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.starts

A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote a

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration fu

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of session