2026

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an

Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or mo

Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grp

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions pri

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to acc

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DS

Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might all

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missi

Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the l

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was genera

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja For

Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.

Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.

Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.

Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.

Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.

Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

Customer Privilege Escalation in Dokan <= 5.0.2 versions.

Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websit

Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.

Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <=

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.

Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, N

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <=

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formid

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.