2026

Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, al

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function atte

Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished j

Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exis

Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scri

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a com

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if th

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18,

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18,

CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to sus

A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and belo

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that on

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to sym

Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capa

Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modificati

Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functio

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterpr

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe

Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code blo

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior t

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor

fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, i

SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a mi

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has b

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminat

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol.

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An atta

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the

EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by

EVerest is an EV charging software stack. Prior to version 2025.12.0, `is_message_crc_correct` in the DZG_GSH01 powermet

GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin at

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attac

Mini Mouse 9.3.0 contains a path traversal vulnerability that allows attackers to access sensitive system directories th

GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can cra

OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers ca

Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE

A vulnerability in the read-only maintenance shell of Cisco Intersight Virtual Appliance could allow an authenticated, l

A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticat

Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE

The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-j

In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv

Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vau

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivatin