2026

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malfor

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malfor

NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exp

NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disc

NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of output

OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inco

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allo

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client wit

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. In 5.2.5188 and earlier, a pre-authenticatio

PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry publish endpoint writes uploaded

PraisonAI is a multi-agent teams system. Prior to 1.5.113, The PraisonAI templates installation feature is vulnerable to

PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry pull flow extracts attacker-contr

PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vul

PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collap

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_upda

coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview v

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, passwor

QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file prev

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() func

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /t

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell comm

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell inje

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability

Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authe

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repe

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only

Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership manag

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operat

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Acco

The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2

A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secur

The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fail

A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically w

Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configu

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to b