2026

A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 2

A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0,

Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been foun

LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langch

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1

Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets th

Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permis

Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the va

Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a vulnerability was found in Outline's

MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local s

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by

BloodX 1.0 contains an authentication bypass vulnerability in login.php that allows attackers to access the dashboard wi

FlexNet Publisher 11.12.1 contains a cross-site request forgery vulnerability that allows attackers to create administra

A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 all

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the Command

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/us

Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform U

Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinc

Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinc

Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who c

Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cros

Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform U

A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1

A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticate

A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remot

The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerabl

MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the d

A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This

Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual

The integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into

GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject ma

WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject

Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated

thesystem version 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious

Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject maliciou

A path traversal vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, th

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the

A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator ac

A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator ac

An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gain

A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote