2026

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string

GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() f

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range(

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_s

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded de

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stor

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and f

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows aut

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and a

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and pr

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user ena

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 t

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation l

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql en

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface onl

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share int

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared us

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2,

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-serve

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in pac

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows au

An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-i

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeU

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and pr

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

An improper access check allows unauthorized users to access com_privacy datasets.

An improper access check allows users to display a list of modules in the frontend.

An improper access check allows unauthorized users to access workflow stage and transition information.

Improper validation leads to a generic XSS vector in the language override feature.

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

Lack of validation leads to an XSS vulnerability in the MFA management views.

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

An improper access check allows privileged users to overwrite media files without editing permissions.

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allo

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import featur

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve

AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create an

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for crit

A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined config