2026

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1

Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in in

Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose de

Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in t

Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vu

Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQ

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus a

LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus a

Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that all

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authenticatio

Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorizat

ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the w

ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in t

GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated

Hirschmann HiLCOS products OpenBAT, BAT450, WLC, BAT867 contains a firewall filtering vulnerability that fails to correc

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an o

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to ver

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Templ

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability w

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability e

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API meth

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vuln

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interfac

Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior t

Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical

OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux

Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow

Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC drive

Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0

Out-of-bounds write in the query processing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat

Improper neutralization of special elements in the authentication components in Amazon Athena ODBC driver before 2.1.0.0

OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it thr

Development and test API endpoints are present that mirror production functionality.

A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

A specific administrative endpoint notifications is accessible without proper authentication.

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arb

Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool.

A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API cal

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive an