2026

Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environmen

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.3

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Pri

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigati

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publicatio

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication e

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forg

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Ref

A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a38

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Po

A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbb

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF b

GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed

GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary wi

Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.1

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.1

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on a

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator m

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From ve

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing

The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution thro

Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview ren

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behavi

Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal

Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDN

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS acce

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints.

An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to

Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create adm

OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL qu