2026

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology

A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply

A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools

A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google

The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to en

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings,

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file

The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scrip

A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file sr

The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modif

The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization byp

The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification

The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. T

A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificat

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/V

Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Dat

Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Es

Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Point

Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This iss

Stack-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects E

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension B

GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Impro

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all right

The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and includ

The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request F

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is v

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting

Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an i

The Blocks for ACF Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software an

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software an

HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API respons

HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure.  The application stores potentially s

HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged action

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Inform

Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allo

Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentica

The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,

The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Obje

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to unauthorized access

The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `boo

A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in

Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFi

The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lin