2026

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitr

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded fil

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_ou

vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a

Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gatewa

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middle

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestA

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal

Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made  RootMappingFs.statRoot  use  Stat  (follows

DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenti

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/u

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injecti

Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between chec

Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.

Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value fo

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.

Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.

Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks.

Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon mcp-g

HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing alrea

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffe

A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calc

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests t

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files und

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-f

vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions a

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL i

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte