2026

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a regist

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), whi

A security vulnerability has been detected in aandrew-me tgpt up to 2.11.1 on Linux/macOS. Affected by this vulnerabilit

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/je

A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-mod

A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middlewa

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request

ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddVi

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKey

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifi

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before versi

Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.2

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS a

Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to ve

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login en

A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf

A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of t

A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-

A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file

A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater o

A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the fi

The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to A

A vulnerability was detected in Open5GS up to 2.7.7. This affects the function ogs_sbi_client_send_via_scp_or_sepp in th

A flaw has been found in Open5GS up to 2.7.7. This impacts the function _gtpv1_u_recv_cb of the file src/upf/gtp-path.c

A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of t

Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command executi

Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transm

There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated u

auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amo

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to vie

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privile

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction

Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the re

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.18.0, four GET

pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From ve

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior t

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From ve

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior t