2026

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_a

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/c

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the Se

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 1

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a th

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as a

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static

A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayContro

A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the fil

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by p

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-enco

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage retur

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can sen

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file c

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML pa

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildca

Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server t

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are c

The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value bein

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in b

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer over

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuff

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsi

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c wh

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0

Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authent

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-s

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection,

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is a

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, suc

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while con