2026

The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versi

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vul

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all v

The Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Stored Cross-S

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the creat

The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct

After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $r

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting clie

When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the loc

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAny

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write priv

Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitr

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege esca

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege esca

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Ma

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing conf

Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and poten

The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.

The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnera

ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attack

ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and veri

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate

GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthentica

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directiv

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject a

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a

ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and

ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and veri

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and veri

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and veri

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security

The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection vi

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all vers

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated

Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users

Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users t

Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the f

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP aut

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) construc

Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStr

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipel