2026

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralizatio

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.update_tool p

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client ac

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_

Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attack

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAu

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previous

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulator_pio_in Use __

PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer a

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Ele

Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics Sma

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten() helper wh

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to ve

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Tran

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Tran

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based b

A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker wh

A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclus

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branc

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, ve

Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation pr

Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a clust

MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob u

MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API.

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute fo

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway Se

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects

Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in

An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control soc

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows rem

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a hig

CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorize