2026

A weakness has been identified in Sanluan PublicCMS 5.202506.d. This issue affects the function execute of the file publ

A security flaw has been discovered in Oinone Pamirs up to 7.2.0. This vulnerability affects the function request.getPar

A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file Pa

A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnect

A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub

A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function ogs_sbi_client_add in the library /lib/s

A flaw has been found in Open5GS up to 2.7.6. This impacts the function ogs_sbi_nf_instance_set_id in the library /lib/s

A vulnerability was detected in Open5GS up to 2.7.7. This affects an unknown function in the library /lib/sbi/message.c

A security vulnerability has been detected in Open5GS up to 2.7.7. The impacted element is the function ogs_sbi_discover

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation

A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file

A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file

### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on

Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted fro

Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to i

Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated at

ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary

WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that

TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload a

WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inj

VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Search Server and VX Search Enterprise serv

Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by p

Sticky Notes & Color Widgets 1.4.2 contains a denial of service vulnerability that allows attackers to crash the applica

My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pasting e

Macaron Notes 5.5 contains a denial of service vulnerability that allows attackers to crash the application by creating

Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting exc

Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject

EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate da

CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary Ja

LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queri

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python

Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticate

MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts

Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local att

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and d

Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attac

Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbi

Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenti

Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute

bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative a

Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrat

libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety check

CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content

Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to

NewsLister contains an authenticated persistent cross-site scripting vulnerability that allows authenticated administrat

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows auth

Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local

WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated att

Advanced System Care Service 13.0.0.157 contains an unquoted service path vulnerability in the AdvancedSystemCareService