2026

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulne

nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-

Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accep

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (X

Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows at

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension typ

MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile

SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsd

Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerabili

People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0,

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-suppli

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-priv

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configurat

Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. F

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Sto

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary f

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and wri

MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected X

novaGallery is a php image gallery. Prior to version 2.1.1, a path traversal vulnerability has been identified in novaGa

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simp

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restric

Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execut

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Z

Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service v

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows

Allocation of Resources Without Limits or Throttling vulnerability in absinthe-graphql absinthe allows unauthenticated d

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK regi

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for D

OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server

i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem

18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno

Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/ru

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (S

Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escal

lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson_stream.c). The end

An issue was discovered in kosma minmea 0.3.0. The minmea_scan functions format specifier copies NMEA field data to a ca

nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. When a client

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and p