2026

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forg

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Anal

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation

Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Config

Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects

Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fiel

Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored wit

Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` c

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/all

iCalendar is a Ruby library for dealing with iCalendar files in the iCalendar format defined by RFC-5545. Starting in ve

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.4` contai

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.7` throug

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.8` throug

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains

MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `m

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigati

Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::from

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API rest

A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API

A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could cra

A malicious SCP server can send unexpected paths that could make the client application override local files outside of

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9

`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branc

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the r

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API end

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-o

A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup

Ruckus Access Point products contain an arbitrary file read vulnerability in the command-line interface that allows auth

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that

A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where thi

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attac

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `F

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based o

Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulne

Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesys

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.

Mattermost Plugins versions <=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows a

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restric

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate decompres

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on