CVE-2026-73073

Vim is an open source, command line text editor. Prior to 9.2.0845, St...

CVE-2026-45532

DataEase versions prior to 2.10.23 on Windows have a path traversal flaw: the server only filters /, allowing attackers to traverse directories via \. The fix is in v2.10.23; no workarounds exist. CVSS 4.0 scores 8.7 (HIGH) with network access and no authentication required. No exploitation detai...

GHSA-X88Q-X2R7-VG3G vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

UBUNTU-CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

UBUNTU-CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

EUVD-2025-210735

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2026-19895

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

CVE-2026-19895 opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

EUVD-2026-59760

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: step-issuer, aws-nuke, octo-sts, cis-operator, whereabouts, dynamic-localpv-provisioner, mailpit, gitleaks, kubernetes-csi-external-provisioner, node-feature-discovery, crossplane-provider-aws-cloudwatchlogs, grafana-alloy, k8ssandra-operator, falcosidekick,...

PT-2026-73035

Name of the Vulnerable Software and Affected Versions opensourcepos Open Source Point of Sale versions prior to 3.4.3 Description An issue exists in the Login Endpoint component within the Login::index function of the app/Config/Filters.php file. This flaw allows for the improper restriction of...

CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: tileserver-gl, jitsucom-jitsu...

GO-2024-2907 vulnerabilities

Vulnerabilities for packages: nuclei...

GO-2025-3604 vulnerabilities

Vulnerabilities for packages: mattermost-fips...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: kyverno, grype, kots, flux-image-automation-controller-fips, wolfictl, trivy-fips, pulumi, zot, crossplane, flux-kustomize-controller-fips, packer-fips, apko, chainctl, task, zarf, tfsec, kyverno-fips, src-fingerprint, kaniko, pulumi-language-dotnet,...

GO-2026-5005 vulnerabilities

Vulnerabilities for packages: prometheus-operator, omnictl-multiarch-fips, telegraf, gatekeeper, zitadel, etcd-fips, containerd, grafana, buildah-fips, calico-fips, etcd, gitlab-kas, tekton-pipelines-fips, minio, kubernetes, snyk-cli, argo-cd-fips, kube-state-metrics, upwind-agent, buildah,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: image-factory, ratify, kyverno, aactl, ko, spire-server, tkn, tkn-fips, docker, trivy-fips, vexctl, teleport-operator-fips, crossplane, policy-controller, sigstore-scaffolding-fips, spire-server-fips, zot, trivy-operator, chainctl, zarf, buildkitd, crossplane-fips,...