2026

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one K

Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generat

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses a

An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution wh

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0,

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0,

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template manag

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formu

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It

An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim ope

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStor

nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation. Prio

nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `VestingCon

Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `network-libp2p` disco

nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `MessageCodec::read_request` and

nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its q

Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy, allowing unrestricted loading of external JavaSc

Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives.

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthentica

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder con

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connecto

Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.

Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, a

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain condi

A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when usin

A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte st

A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:]

A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during

A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when uti

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive o

A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attem

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filen

A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when t

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effect

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's rea

An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send th

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences.

The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across file

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device

A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the