2026

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authentic

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:re

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace env

Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 ar

Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assis

A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcf

A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /gofor

A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknow

A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown fun

A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manip

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle UR

Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command process

Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow w

Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Laun

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (f

elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results i

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Fina

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Fina

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21,

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking applic

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1812, the listing ta

nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the ema

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 20

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 20

Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extens

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created MCP (Model

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoi

LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side

LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth

A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the

A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function

Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software

Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap

Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirm

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` met

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_file` and `get_ap

Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host

Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoint

Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic c

Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k

A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /ad

A vulnerability was detected in letta-ai letta 0.16.4. This issue affects the function resolve_type of the file letta/fu

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `p

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `categories.json.php` endpoint,