2026

ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::ge

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoin

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenti

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenti

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerabi

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_u

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulner

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `pt

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the

The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A given

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `pt

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exi

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2

Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, Hot Chocolate's

SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architectu

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in

Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint (PATC

monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoi

Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml() function in Ki

The Pz-LinkCard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blogcard' shortcode attribute

miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior co

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior co

graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares per

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in Abs

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to N

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScri

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new in

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (c

The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 hav

libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in

radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCoo

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template en

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style

next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.

OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is co

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in da

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultG

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 thro

Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide defaul

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynam