2026

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and usern

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows

When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or s

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSi

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachmen

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentica

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D

In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when un

WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the af

Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to for

Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the pr

Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical confi

Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary c

OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbit

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value fo

Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. Whe

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatMo

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter

Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects

A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44. Affected is an u

The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1

A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /

A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the

A vulnerability was identified in Page-Replica Page Replica up to e4a7f52e75093ee318b4d5a9a9db6751050d2ad0. The impacted

A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /gof

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated att

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated att

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. P

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.39.0, the cpp-httplib HTTP

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypas

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter fram

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Z

dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI ins

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.

Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a h

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. I

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attack

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in

A vulnerability was found in Tenda AC5 15.03.06.47. Impacted is the function formWifiWpsOOB of the file /goform/WifiWpsO

A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/

Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to system

Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui

Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulner

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.