2026

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on unin

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains a stored cross-site scriptin

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains an Insecure Direct Object Re

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across differe

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t

Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulne

Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{file

A reflected cross-site scripting issue exists in URL handling.

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts exe

Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation.

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)

Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E

Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.1.0

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security). Supported vers

Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-2

Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-2

Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-2

Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.

Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager). Supported ver

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Auth

Vulnerability in the Oracle iAssets product of Oracle E-Business Suite (component: Internal Operations). Supported vers

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components).

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components).

Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Opera

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search API

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a vali

Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.3.0 to 2.28.1, unescaped Project Name allows an at

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)