2026

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerabili

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cach

HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identifi

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected c

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability

Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, p

Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code cont

Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Disco

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-f

OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze,

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify t

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action,

The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could al

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, th

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.

OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authenti

Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an at

Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, th

Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From ve

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual as

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. Prior to version 1.21.0,

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version

LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied ra

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CS

Idno is a social publishing platform. Prior to version 1.6.4, there is a remote code execution vulnerability via chained

Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871, a Path Traversal vulnerability was identified i

Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talis

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memca

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header

Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote co

WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulner

WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exis

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerabil

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs curren