2026

CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/

A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endp

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-conf

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-t

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword p

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the dec

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a sound

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vul

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientCl

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.lang

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin g

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration fo

Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core T

An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/worksp

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI

Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Pro

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed

stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission

stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching me

Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malici

Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the syste

A local privilege escalation vulnerability in ESET Inspect Connector.  The vulnerability was caused by improper authenti

Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extensio

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than in

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/r

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js a

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publicatio

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/o

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/user

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the aut

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body t

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploadin

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetD

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources le

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling ca

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store atta

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connecti

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can a

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call Template

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssF