2026

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin da

Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that all

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerabili

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action

Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint th

SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve,

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the dat

Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execu

Reflected Cross-Site Scripting (XSS) vulnerability in Navigate Content Management System. The vulnerability is present i

Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vu

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP f

When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separ

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint va

ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::ge

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoin

next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the

GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access cont

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJA

mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRe

A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with admi

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hy

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Malici

A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a loca

An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privi

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unau

The .NET Remoting framework used by OpenText Fax (RightFax) includes known security vulnerabilities that could be exploi

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simula

Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specia

HP System Optimizer might potentially be vulnerable to escalation of privilege. HP is releasing an update to mitigate th

Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic o

Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than c

A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions.

The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" a

CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device info

The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform.  It has been identified as crypt

A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-le

.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows

Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in upKeeper Solutions u

Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability e

Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there i

Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the Pay

ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCR

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.

The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper