2026

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation l

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql en

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface onl

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share int

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared us

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overw

Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document template

Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstat

MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects M

MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit a

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.1, downloadable product fi

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `ser

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `Client

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged

FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticate

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged st

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Requ

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cros

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff ac

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the PayPalEmail payment

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, a race condition in the

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code i

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenti

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/u

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injecti

A validation vulnerability has been identified in certain web features related to file management or upload in several p

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API requ

Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unboun

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a deni

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised acce

A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM

uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability that may allow an auth

AIL Framework contains a path traversal vulnerability in its PDF object handling. Prior to commit 14c618fce4d1df02358717

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote

HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary c

PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to e

Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calend

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensiti

External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary co

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application o

** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows

** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows

CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptogr

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5