2026

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions a

The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflect

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include whe

The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downl

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label reco

The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles a

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to man

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJ

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-accou

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source o

The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the pay

The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translat

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notific

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes tha

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manip

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values th

A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelMa

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, an

A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewa

A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_

Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a c

Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a c

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that

Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction withou

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays wit

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, C

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execut

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by suppl

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the script

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated a

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attack

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setg

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content val

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard b

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 f