2026

wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem

A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit

A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastor

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can

Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant tha

Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can r

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vM

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows un

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Medi

Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured A

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket La

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded S

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Sli

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element P

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element P

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addon

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz A

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Contr

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access C

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table ali

Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option i

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redire

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document bei

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimi

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthen

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated conta

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level u

The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configurati

The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputt

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requestin

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a le

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, all

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file i

The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on o

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as dir

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-l

A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one

src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_M

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it a

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to un

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to