2026

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulne

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Informati

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the

The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecur

The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitiv

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges befor

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to,

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPr

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vul

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is

TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by resolving a hostname o

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms

vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial us

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed c

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability thro

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are

The postman_download module uses the workspace name field from the Postman API to construct the local directory path wit

The github_workflows module constructs local directory paths from user-controlled repository names without validating fo

The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authent

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, re

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their

In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference the SystemBuffer pointer withou

In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security desc

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenti

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the

XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts coul

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP m

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK vers

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level pri

markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer:

PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc.

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vuln

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection,

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fai

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SS