2026

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in al

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote den

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denia

An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allow

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysU

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysD

The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and includi

ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF token

ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a

Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrato

ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If process

ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected produc

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing c

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and in

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr par

ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files

Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and the

When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify t

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password use

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done u

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following cond

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the s

The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in al

The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2

The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalc

csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the tem

The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modifi

The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.a

Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a l

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git pus

The Snow Monkey Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-slick' attribute

A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-ra

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blin

Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If the

Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS ve

Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated at

Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigg

Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to acce

Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged act

Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to tri

Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to exec

Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary

Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensi

Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique id

The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a mi

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vul