2026

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corrup

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs_lo

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH_HLEN to be pullable in ife_de

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handlin

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length s

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the

In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientG

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path va

The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capab

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it acce

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauth

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused T

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download data

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arb

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrato

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic impr

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, al

An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker t

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thund

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ES

Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14,

Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154

Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic

An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Sup

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Support

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security).

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions th

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authenticatio

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authenticatio

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authenticatio

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploita