2026

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From ve

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.acc

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks lice

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular

bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is i

Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/gr

The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthe

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users

A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the conten

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. Prior

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In ve

Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compou

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissi

Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists

FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF

FastGPT is an AI Agent building platform. Prior to version 4.14.17, FastGPT had an inconsistent SSRF protection gap in M

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who c

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in

Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical v

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Ka

Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added i

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packa

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packa

FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insuffi

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.1

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists

FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Pu

SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoin

ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allow

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnera

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to versio

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and u

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin func

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with reta

Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and