2026

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename(

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename(

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP mes

A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipul

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Ex

A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Perfo

An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access co

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthe

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the termi

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebU

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legac

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /a

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENAB

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the stand

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open Web

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEB_

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt inject

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organiz

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1

GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions pri

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated ac

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated a

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 micr

A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could

Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flow

Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flow

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-

Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flow

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsan

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ th

SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated a

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality.

Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote att

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnera

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning end

In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to rem

Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An unauthenticated remote attacker ca

Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An unauthenticated remote attacker can

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validat

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Pyt

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm wri

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A succ

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that con