2026

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature ret

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kuber

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correct

Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` per

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize

Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Cu

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on

A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corrupti

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because

A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Cl

Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct

Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.

A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to acc

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user

WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/Aut

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation at

EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow

Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attack

An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitiv

Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote at

An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitiv

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed t

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreD

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket tr

CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the proc

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb w

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corrupt

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corrupti

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corrupt

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cg

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verif

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRe

CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/

A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address

A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the a

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior t

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endp

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-conf

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin acces