2026

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability ex

Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forger

AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a

Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via th

Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path

Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty term

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the

Actual is a local-first personal finance tool. The `POST /openid/config` endpoint in Actual Budget's sync-server version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.

The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbit

The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifyin

Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in clearte

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Solidtime is an open-source time-tracking app. Prior to version 0.12.2, Solidtime defines an explicit invitations:view a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predict

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmwar

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argumen

Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-

Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds write vulnerability that

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is a cache isolation issue affe

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is an unauthenticated denial-of

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taki

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before

MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 1

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to req

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API resp

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to san

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce Permiss

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a