2026

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor s

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the termin

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated term

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who i

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery sy

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Comm

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileg

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only per

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-adm

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concaten

facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unau

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows u

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Ap

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. Th

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authentica

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows admi

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, al

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cov

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows

Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthentica

Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corru

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a

The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modu

Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extrac

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote att

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an i

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized c

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows att

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privile

SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAp

Unauthenticated Broken Access Control in Gillion <= 4.13 versions.

Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.

Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce &#8211; Checkout Manager <= 3.0.5 versi

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.