2026

Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can po

Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows

Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly o

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upst

Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default confi

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some

There is a memory leak in NI grpc-device BeginSidebandStream that may result in denial of service due to memory exhausti

There is an unchecked enum cast vulnerability in NI grpc-device BeginSidebandStream that may allow an attacker to trigge

There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attack

There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may

There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an a

Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configuration

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under defaul

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-au

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default

Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under defaul

Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication cap

Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in f

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return suc

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privileg

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authenti

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clus

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read p

Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payloa

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item iden

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reso

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process t

The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all version

Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileg

The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, a

The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.

The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path v

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary

The Woosa – Marktplaats for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in

The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 vi

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedF

The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includi

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom booking fi

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of b

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versio

The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to S

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vuln