2026

Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authenticat

Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) al

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly h

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequ

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a ca

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, with NC_SECURE_ATTACHMENTS=true, an authe

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a passwor

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequ

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users s

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with kno

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (pack

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests us

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create pe

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HT

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise an

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed valu

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin calle

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authentic

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the upload-by-URL path did not enforce NC

FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-constructi

FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online s

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 unti

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink reference

Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authentica

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Temp

FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version

DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can prepare an URL that

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause

Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. Thi

Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing t

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass v

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, wh

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, se

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, se

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patc

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router mod

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NP

Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow.

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud C

Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on i

Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation

The vulnerability arises when the system fails to properly validate the 'email' field during the authentication process,

Vulnerability involving the exposure of sensitive data provided without adequate protection. The API exposes email and p