2026

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to versi

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to S

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/star

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) th

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validat

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjace

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscrip

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attacker

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticate

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined pale

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCre

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report conf

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configurat

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configurati

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuratio

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configurati

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that all

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy conf

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration tha

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unaut

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirem

Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s valid

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive Id

Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the c

NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to

Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing cont

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in int

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a diffe

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden t

DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS an

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled n

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RE

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPuri

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its datab

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font