2026

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is u

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated custo

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and pr

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and pr

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers t

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metada

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and pr

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsAp

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736

A NULL pointer dereference in smooth_parse_stream_index() in src/media_tools/mpd.c in GPAC master HEAD before commit b35

Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GA

Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper passwor

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execut

An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 all

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtri

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The pr

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeho

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is ass

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request f

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve me

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with t

OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a()

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unr

Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution throu

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI schema importer valid

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates t

FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT allows an authenticat

Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/s

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks f

The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arb

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13

The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing s

The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organizatio

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that al

FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege esc