2026

Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export de

Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DN

Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes

Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.updat

The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta

Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitr

The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the

The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-S

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 202

OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `saf

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` ac

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @papercl

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. The

STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Infor

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system,

Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to versio

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScri

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’

A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math

A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token

IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated us

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1

IBM Guardium Data Protection 12.1 is vulnerable to cross-site scripting. This vulnerability allows an administrative use

IBM Guardium Data Protection 12.1 is vulnerable to stored cross-site scripting. This vulnerability allows an administrat

IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the system. An attacker

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting i

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC end

A path Traversal vulnerability exists in Ziostation2 v2.9.8.7 and earlier. A remote unauthenticated attacker may get sen

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnera

The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the

In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability c

IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation, allowing unauthori

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access m

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user a

IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to m

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authe

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Sq

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulatin

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSR

Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `R

radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jell