2026

A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attac

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior t

thingino-firmware versions up to the firmware-2026-03-16 release contains an unauthenticated os command injection vulner

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `F

Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the Li

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based o

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based o

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based o

H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `sta

goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in

Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulne

Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesys

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.

Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Pl

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separ

Mattermost Plugins versions <=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows a

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restric

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate decompres

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced

Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to co

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-cont

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an aut

Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStr

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Versions st

Briefcase is a tool for converting a Python project into a standalone native application. Starting in version 0.3.0 and

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

Sakai is a Collaboration and Learning Environment (CLE). In versions 23.0 through 23.4 and 25.0 through 25.1, group titl

EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop

EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorizat

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (potential memo

OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitra

Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (

EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_tra

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_session_setup cop

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phas

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-free. This i

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::map<std

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::queue`/

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to th

The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-ne

Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.