2026

Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attac

PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scriptin

Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 14

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit W

A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution an

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unaut

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOn

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngi

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component override system transpiles user-supplied

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Eas

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 TableOn

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active

Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workfl

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit W

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Porta

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of st

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache re

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee componen

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connecti

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Produc

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport

The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.

Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.

Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.

Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.

Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.

Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.

Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.

Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.

Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.

Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.

Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.

Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.

Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.

Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.

Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.

Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.

Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websit

Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.

Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / Stell

Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.