2026

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to versio

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the M

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an In

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attack

Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platfor

Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms

Out of bounds write and reads in openSeaChest’s --showSCSIDefects in Seagate’s openSeaChest v25.05.3 on all supported pl

A vulnerability was determined in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The impacted elem

A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The affected element i

Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested dire

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7

A vulnerability has been found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. Impacted is the f

A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of t

Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability

Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows network-

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (wi

Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure fil

Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure fil

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows u

authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Sou

CloudburstMC Protocol is a protocol library for Minecraft Bedrock Edition. Prior to version 3.0.0.Beta12-20260420.182526

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of st

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-

A vulnerability has been found in SourceCodester Human Resource Management 1.0. Affected by this vulnerability is an unk

A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function of the file /index.

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This

Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially

Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service

An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. Thi

The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, a

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_priv

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authen

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packe

Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via u

Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via at

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-te

Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party ori

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set wit

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response proces

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to th

CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has