2026

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form renders user-controlled parameters

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form (beta feature) accepts a user-suppl

SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenti

Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to

Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the s

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API crea

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNot

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studioc

OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live Event

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage ma

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user ca

An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Ba

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiyin

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiyin

A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could

A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user ca

A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local pr

A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could all

An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master.

An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benk

Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers t

A weakness has been identified in OpenBMB XAgent 1.0.0. Affected by this vulnerability is the function workspace of the

A security flaw has been discovered in LockerProject Locker 0.0.0/0.0.1/0.1.0. Affected is the function authIsAwesome of

A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file lib

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

PingPong is a platform for using large language models (LLMs) for teaching and learning. Prior to 7.27.2, an authenticat

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vul

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted S

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-brac

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelbla

xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credenti

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint (P

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unb

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded r

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Serv

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only l

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if Himmelbl

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lac

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action suppo