2026

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's paren

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level u

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it in

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticate

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating i

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection act

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Script

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all version

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before stori

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown functi

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown functi

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated rem

Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the expos

Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-s

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regen

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the no

A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actor

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3

A component of one of the Motorola system applications was exported without permission, allowing for the revocation of r

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An ob

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.

Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.

Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages.

The Joyland AI app accepts any TLS certificates from any server without validation.

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to acce

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay

Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin e

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerabi

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Pro

A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enab

Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU tim

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exp

Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server befor

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attac

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated admi

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker t