2026

Unauthenticated Local File Inclusion in Especio <= 1.0 versions.

Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.

Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.

Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.

Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.

Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.

Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.

Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.

Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.

Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.

Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.

Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.

Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.

Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.

HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where

Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions.

Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions.

Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.Thi

Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.

HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, t

Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.

Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.

Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions.

Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.

Unauthenticated Local File Inclusion in Geya <= 1.15 versions.

Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.

In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local

In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. T

In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass.

In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic er

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allow

Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with ad

Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with ad

Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.

Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Contro

Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security

Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded

Cross-Site request forgery (CSRF) vulnerability in Andy Moyle Emergency Password Reset allows Cross Site Request Forgery

Cross-Site request forgery (CSRF) vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery. This iss

Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control S

Missing Authorization vulnerability in Jegstudio Startupzy startupzy allows Exploiting Incorrectly Configured Access Con

Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Con

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversatio

: Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Acce

Missing Authorization vulnerability in Shareaholic allows Exploiting Incorrectly Configured Access Control Security Leve