2026

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary ve

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary v

Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell C

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vuln

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_an

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseMo

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_he

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co.

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.g

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Sof

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated at

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated at

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that al

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authe

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the e

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRo

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to

Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.

Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.

Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.

Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autosh

Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.

Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.

Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.

Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.

Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown

Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allo

Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This c

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusti

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a g

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when hand

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider n

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfi

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX

Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronizat