2026

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results e

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote att

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGr

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signa

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stor

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) du

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Script

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-medi

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's'

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in a

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admi

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress i

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress i

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripti

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs durin

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before o

HCL Digital Experience is affected by improper input sanitation.  This can result in HTML injection which could be lever

A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/c

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the funct

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized mod

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderControlle

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanl

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/S

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Crede

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the

A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file s

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware tha