2026

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multip

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessRes

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functional

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>`

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flo

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsa

A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without en

Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the r

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete ot

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that ex

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authent

Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to r

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers

A malicious user with physical access to the device can boot the switch from factory settings without authentication, us

Default factory credentials with administrative access are enabled and persist even after configuring other administrato

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. T

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows r

Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold()

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfc

HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL

Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not pr

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Indu

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An auth

A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on wh

The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPF

Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-ima

Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Rec

Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Rec

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when pars

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership chec

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acti

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its setting

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly

Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Conf

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-a

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Aud