2026

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks a

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Acce

Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allo

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentica

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalat

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configur

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configur

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Conf

Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Conf

Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-pa

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetRevi

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Cla

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vuln

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Limitation of a Pat

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignm

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBloc

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing use

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failin

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnera

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles

Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Cont

The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-b

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receiv

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two

The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it

An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed thr

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter respon

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-cr

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset u

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacke

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.

A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper s

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to u

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-c

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction en

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digest