2026

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, this vulnerabil

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password re

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contain

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core securi

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side R

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side R

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow co

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vuln

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mas

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific fl

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific fl

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remo

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent al

LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.load

Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_fi

Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Masto

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contai

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Cont

pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submissio

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path trave

The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0

OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Exte

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.

This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privile

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandb

Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromi

Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the re

TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default

OpenClaw before 2026.4.20 contains an improper authorization vulnerability in paired-device pairing management that allo

OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows tru

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC u

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-e

In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm