2026

lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML in

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Z

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 12

A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of t

A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file

A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_B20221024. The impacted element is the functi

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-s

ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fie

Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed l

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73

SymCrypt is the core cryptographic function library currently used by Windows. From 103.5.0 to before 103.11.0, The SymC

dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API fu

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is pub

EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/template

Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the

Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admi

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/custo

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publ

Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Fo

openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exist

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore

openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exist

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem (Exynos 980, 850, 990, 1080, 2100, 12

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 21

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setSchedul

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function CsteSystem of the

A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhausti

An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 210

An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 21

In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to impr

A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /

A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown f

A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Im

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to 2.10.2, confronta_

defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pa

Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allo

Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugi

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the admin

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post

Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path t

Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.

Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML re

Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vulnerability exists in the CKEditor upload

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save

Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allo