2026

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to versio

A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /gofo

A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addr

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or

Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket bac

Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API reli

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fing

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the fil

A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unk

A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected by this vulnerability is an un

The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of

A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal v

Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 improperly use the validation

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cros

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method inj

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expr

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to tr

SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/

Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied fl

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Ulloady is a file uploader script with multi-file upload support. A Stored Cross-Site Scripting (XSS) vulnerability exis

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, p

Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3

In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content"

A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue

The vulnerability exists in the UPnP component of TL-WR841N v14, where improper input validation leads to an out-of-boun

Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affect

Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Au

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forg

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Anal

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation

Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Config

Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects

Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fiel

Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored wit

Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerabilit

Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` c

Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users n

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/all

iCalendar is a Ruby library for dealing with iCalendar files in the iCalendar format defined by RFC-5545. Starting in ve

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item