2026

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view refle

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadata

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript application

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, th

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated r

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to a

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev developmen

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` developm

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, application

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can

In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, s

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive informatio

Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin d

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in MRV Technology For

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access C

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-compani

Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allow

Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access

Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configur

Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete D

A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of t

A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown proce

A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown co

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Manag

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footpr

A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the fi

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group The

Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inj

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fe

YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions be

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old passwo

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to in

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only t

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticate

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthentica

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restr

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) ma

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes