2026

Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.1

Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firef

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR

Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.

A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for th

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Sh

syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vu

A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earli

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPor

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 1

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Esca

Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exp

Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.

Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.

Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.

Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.

Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.

Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.

Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inc

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / Stell

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Contro

Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.

Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Confi

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpf

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page ca

The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripti

Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerabilit

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up t

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameter

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in version

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 Thi

Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and earlier. If this vulne

The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu

On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintain

Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successfu

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABT

A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can

A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` compo

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracke

A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially craf