2026

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer

Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issu

Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollm

Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-supplied IP address heade

Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to i

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) r

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Con

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset,

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with m

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / da

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST A

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the N

Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JW

Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows auth

mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command ex

Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The devi

Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did n

Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inj

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM managem

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Con

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.

Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middlewa

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's

gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf's Reference S

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-contr

Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit sema

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulne

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows

Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers. From 2.4.0, t

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELE

Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to

Improper Control of Generation of Code ('Code Injection') vulnerability in Yordam Information Technology Consulting, Tra

Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Indus

A side-channel attack, which requires a physical presence to the TPM, can lead to extraction of an Elliptic Curve Diffie

CWE-601 URL redirection to untrusted site ('open redirect')

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execut

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClien

Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feed

Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoi

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPip