2026

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s ce

Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub

Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs

The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and in

The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin

The Custom Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up

The WP Social Meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions

The TP2WP Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Watched domains' textarea

The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[labb_

Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists i

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with

Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, Rep

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent nod

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with

Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API

Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52,

Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability e

Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via U

OpenEMR is a free and open source electronic health records and medical practice management application. In versions up

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based li

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in Open

WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository con

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version

Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly esca

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textConte

The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackS

WireGuard Portal (or wg-portal) is a web-based configuration portal for WireGuard server management. Prior to version 2.

Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotati

The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0

ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's

ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta i

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prio

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can cra

NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file a

ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.

Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete

rldns is an open source DNS server. Version 1.3 has a heap-based out-of-bounds read that leads to denial of service. Ver

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `ja

Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing `image.domai

Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`

Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (`read_file`, `e

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

GPAC is an open-source multimedia framework. In versions up to and including 26.02.0, a stack buffer overflow occurs dur

TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A v

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vuln

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file conta