2026

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is su

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prio

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes accoun

The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password c

Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.

The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive file

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintex

A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitiza

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing p

The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset. This flaw allows an

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.Ge

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/envi

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bas

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerab

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image prox

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injecti

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enfor

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SEC

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticat

Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /enviro

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-bas

Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.19.0 and earlier, the protectedProcedure middleware

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint th

MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inj

A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization h

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.0 and earlier, the deleteRegistry function in Dok

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrator

Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated atta

SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of use

OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped client

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows re

OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to

OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated sende

QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malici

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same

OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-autho