2026

Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a

Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an au

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is posit

The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before cr

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX r

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notificati

Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToStri

Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attr

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account in

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized oper

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions befo

An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By suppl

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning i

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a with

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet trans

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handle

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses durin

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintex

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local a

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and  authentication tokens in log fil

The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when th

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, al

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entrop

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration

A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file

A command injection vulnerability exists in the WebTools administrative interface handling configuration download or fil

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.

An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Broc

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsan

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data dur

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_li

An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a

In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS admin

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions b

An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions bef

An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS ver

containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-boun

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when acces

A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when l

The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an