2026

UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to view any user profile o

UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any f

UBB.threads is vulnerable to Blind SQL Injection, allowing attackers with access to the Members in Control Panel to inte

UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input in certain requests, enabling

uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an

UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fails to properly saniti

Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's

A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the de

A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address p

An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" m

Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-appl

A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V3

Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network

Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and pr

An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googl

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googl

SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An atta

The Fancy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' shortcode attr

8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compile

The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortc

Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps

The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenti

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configu

In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could l

The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is

The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysb

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to,

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPre

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed

The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includin

The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all ver

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerabl

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthe

The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information

The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vuln

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic

The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cr

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_dire