2026

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.4` contai

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` throug

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.7` throug

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.8` throug

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains

MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `m

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigati

Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::from

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API rest

A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the

A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnera

A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread_pascal_string function when processing

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a m

A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could cra

A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker c

A malicious SCP server can send unexpected paths that could make the client application override local files outside of

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9

`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branc

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the r

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with b

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traver

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API end

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-o

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU u

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can s

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format cod

A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup

Ruckus Unleashed contains a remote code execution vulnerability in the web-based management interface that allows authen

Ruckus Access Point products contain an arbitrary file read vulnerability in the command-line interface that allows auth

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that

A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where thi

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versio

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelat

Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.4, a stack-based

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php co

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitt

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via