2026

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.

Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.

Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.

Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.

Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.

Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Config

Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.

Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.

Editor Privilege Escalation in AI Engine <= 3.4.9 versions.

Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.

Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.

Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.

Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.

Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.

Subscriber Broken Access Control in Bookify <= 1.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Eli&#039;s WordCents adSense Widget with Analytics <= 1.3.03.27 versions.

Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.

Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.

Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.

Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.

A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack f

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file cont

A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file,

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor d

Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trig

A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorr

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser rea

A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse

Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows auth

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges

Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /sto

An input handling flaw in the HTTP refresh token process of LLDAP v0.6.2 allows attackers to cause a Denial of Service (

An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillec

A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attac

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan inte

Incorrect access control in the share-based read endpoints of Sismics Docs (Teedy) v1.11 allow unauthorized attackers to

Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sens

An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute

An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS)

Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to escalate p

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary cod

An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Ser

An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Serv

An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names cont