CVE-2026-33039

WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL, but only checks the initial URL. When the initial URL responds with an HTTP redirect Location heade...

EUVD-2026-13488

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allow a moderator to edit site policy documents ToS, guidelines, privacy policy that they are explicitly prohibited from modifying. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 conta...

CVE-2026-32888

CVE-2026-32888 affects Open Source Point of Sale (PHP, CodeIgniter). A SQL Injection exists in the Items search functionality when the custom attribute search feature (search_custom) is enabled: user input from the search GET parameter is interpolated directly into a HAVING clause without paramet...

EUVD-2026-13498

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled searchcustom filter, user-supplied input from the search GET...

CVE-2026-32888 Open Source Point of Sale is Vulnerable to SQL Injection Through its Item Search Functionality

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled searchcustom filter, user-supplied input from the search GET...

H3 Security Vulnerabilities

H3 is an open-source HTTP framework developed by H3. Versions 2.0.0-0 to 2.0.1-rc.14 of H3 contain security vulnerabilities. These vulnerabilities stem from a Host header spoofing issue in NodeRequestUrl, which may allow middleware to bypass security checks...

Traefik security vulnerabilities

Traefik is an open-source reverse proxy and load balancing tool developed by Traefik. Versions of Traefik such as 2.11.40, 3.0.0-beta1 to 3.6.11, and 3.7.0-ea.1 contain security vulnerabilities. These vulnerabilities stem from issues with the TLS SNI pre-sniffing logic, which may allow for...

Langflow security vulnerabilities

Langflow is an open-source visualization framework developed by Langflow for building multi-agent and RAG applications. Versions of Langflow prior to 1.9.0 contained a security vulnerability. This vulnerability stemmed from the deleteapikeyroute endpoint, which did not verify the ownership of the...

Harden-Runner security vulnerabilities

Harden-Runner is a program open source by StepSecurity. It provides network exit filtering and runtime security for both GitHub-hosted and self-hosted runners. Harden-Runner versions 2.15.1 and earlier contained security vulnerabilities, which stemmed from an exploit that allowed DNS queries to...

Itsourcecode Online Frozen Foods Ordering System SQL Injection Vulnerability

itsourcecode Online Frozen Foods Ordering System is an open-source online frozen food ordering system developed by itsourcecode. Version 1.0 of the system has a SQL injection vulnerability, which arises from incorrect handling of the parameter productname in the file admin/admin/editmenu.php,...

Itsourcecode Online Frozen Foods Ordering System SQL Injection Vulnerability

itsourcecode Online Frozen Foods Ordering System is an open-source online frozen food ordering system developed by itsourcecode. Version 1.0 of the system has a SQL injection vulnerability, which arises from incorrect handling of the parameter productname in the file admin/admin/editmenuaction.ph...

Itsourcecode Online Frozen Foods Ordering System SQL Injection Vulnerability

itsourcecode Online Frozen Foods Ordering System is an open-source online frozen food ordering system developed by itsourcecode. Version 1.0 of the system has a SQL injection vulnerability, which stems from incorrect handling of the parameter SupplierName in the file/admin/admineditsupplier.php,...

DB-GPT Code Issues and Vulnerabilities

DB-GPT is an open-source development framework for AI-native data applications by eosphoros, based on AWEL and proxies. Versions of DB-GPT 0.7.5 and earlier have code vulnerabilities. These vulnerabilities stem from the unlimited uploading feature in the function moduleplugin.refreshplugins withi...

File Browser security vulnerabilities

File Browser is an open-source file management interface developed by File Browser. It allows for the uploading, deletion, previewing, and editing of files within a specified directory. Versions of File Browser 2.61.0 and earlier contain security vulnerabilities. These vulnerabilities stem from...

Open Source Point of Sale SQL Injection Vulnerability

Open Source Point of Sale is an open-source sales point system based on the Open Source POS framework. Open Source Point of Sale has a SQL injection vulnerability; this vulnerability stems from the project’s search function, which allows for SQL injections, potentially leading to arbitrary SQL...

Anchorr security vulnerabilities

Anchorr is an open-source Discord bot developed by openVESSL that integrates media search and notifications. Versions of Anchorr 1.4.1 and earlier contain security vulnerabilities. These vulnerabilities stem from a storage-oriented cross-site scripting vulnerability in the Jellyseerr user selecto...

MindSQL SQL injection vulnerability

MindSQL is an open-source database interaction and retrieval enhancement generation library developed by MindInventory. Versions of MindSQL 0.2.1 and earlier contained a SQL injection vulnerability. This vulnerability stemmed from the askdb function in the mindsql/core/mindsqlcore.py file, which...

PT-2026-26544

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled search custom filter, user-supplied input from the search GET...

Fullchain Access Control Vulnerability

Fullchain is an open-source CTF competition platform developed by CTFer.io. Versions of Fullchain prior to 0.1.1 contained access control vulnerability issues. These vulnerabilities were caused by incorrect network policy configurations, and could lead to lateral movement attacks...

Admidio code issue vulnerabilities

Admidio is a set of open-source member management systems developed by the Admidio team. This system supports features such as member lists, event management, message boards, photo albums, and downloads. Versions of Admidio 5.0.6 and earlier have code vulnerabilities; these vulnerabilities stem...