2026

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAge

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent`

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts in

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content t

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag with

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.acce

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enab

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user ac

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Htt

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any b

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with role

An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to a

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. When the domain

varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF

There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notifica

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google

The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to en

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all right

Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.

The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpa

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CL

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-a

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryptio

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryptio

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filt

Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's

MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not en

An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys wit

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve me

Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution throu

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates t

The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded de

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stor

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and f

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows aut

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user ena