2026

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 t

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an atta

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, f

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Tracca

Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in L

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior,

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access.

Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos fro

Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_typ

Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do

Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthoriz

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.

Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.

Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.

Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.

Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.

Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.

Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.

Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.

Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Contro

Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.

Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell t

Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.

Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.

Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.

Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.

Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.