2026

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version

bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version 3.1.22, an integer o

llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml

WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.10.0, an authorization flaw in updateComment al

Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Ser

A vulnerability was identified in SourceCodester Online Catering Reservation 1.0. Impacted is an unknown function of the

A vulnerability was determined in itsourcecode sanitize or validate this input 1.0. This issue affects some unknown proc

A vulnerability was found in SourceCodester E-Commerce Site 1.0. This vulnerability affects unknown code of the file /pr

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a miss

The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in

The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up

The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_pop

Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior t

Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing malformed UL NAS Tra

Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing a malformed NGAP Loc

Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing NGAP messages with i

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted

Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack o

Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerabil

Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to v

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to v

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToD

The WP Job Portal plugin for WordPress is vulnerable to SQL Injection via the 'radius' parameter in all versions up to,

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answe

Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1,

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In vers

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerabili

A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the fi

A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the fu

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cro

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call

OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authori

OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added