2026

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an att

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscrib

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitra

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1,

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body t

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with vali

CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of S

9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate use

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Serv

WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded

CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate

CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate kno

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy s

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters usi

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 unti

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2,

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploadin

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetD

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources le

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 funct

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling ca

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD us

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Ar

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store atta

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connecti

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can a

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call Template

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of

o   CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers

CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with inti

CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 1

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 1

CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers

CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to

CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledg

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io aut