2026

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to re

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existi

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated atta

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers

YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated att

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedr

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-ha

Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as dir

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticat

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clon

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to deg

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading o

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scorin

Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 10

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows au

Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Edi

SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn met

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, a

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot a

A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unkn

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflecte

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sen

Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sen

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin fo

Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Con

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerabilit

Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request F

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Proper

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' paramet

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cr

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to I

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the

Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget outpu

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amoun

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server,

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the Wo

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and ex

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its

Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Cas

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before r