2026

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.1

Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelis

Syntx's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist s

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() f

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash col

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without th

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read pe

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) t

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potent

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the req

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `_

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin

Symantec Data Loss Prevention Windows Endpoint, prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 M

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is abl

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configurat

Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the a

A flaw has been found in SourceCodester RSS Feed Parser 1.0. Affected by this issue is the function file_get_contents. T

A vulnerability was detected in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function child_

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when convertin

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Di

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerabl

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly

OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But

A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to t

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a com

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_p

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to t

A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing th

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/f

Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redire

Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/v

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during

A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/pack

Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows u

SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the mysqlColumnAsInsert function in file pl

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that

CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud ser

CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validati