2026

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header fo

In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers

In the Linux kernel, the following vulnerability has been resolved: batman-adv: avoid OGM aggregation when skb tailroom

In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_multiport: validate range encoding in

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free u

In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload l

In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - limit RX SG extraction by receive

In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challeng

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in p

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_m

In the Linux kernel, the following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_l

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_s

LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTM

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @c

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated si

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds rea

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of

Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and ex

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's c

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds rea

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to befo

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Pr

Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expr

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option d

pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered e

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection

Mojic is a CLI tool to transform readable C code into an unrecognizable chaotic stream of emojis. Prior to 2.1.4, the Ci

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buf

SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a d

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through

SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, SiYuan desktop renders notification messa

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumerat

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-b

Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.ym

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gi

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gi

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) th

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.