2026

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentic

The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and

The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action

The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitte

The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address sele

NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local a

NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can

NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-a

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers ca

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml in

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread C

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaus

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: f

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code In

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST ver

Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalat

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forg

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authent

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content v

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drup

Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Merma

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carous

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decouple

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Alloc

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud

Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: f

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform vers

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform v

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform all

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform vers

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: f

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This i

Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affect

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform vers

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform all

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform all

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform all

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform all

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform all