2026

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within t

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login in

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing s

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE)

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment vali

libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before an

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and in

NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the fi

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them d

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.1

libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and includ

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id,

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitr

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciou

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the clien

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated f

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.M

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?dat

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <ou

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side R

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability i

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, i

A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an auth

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name`

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is cor

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAPro

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanit

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user perso

Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry an