2026

A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file fun

Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.

Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.

Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.

Contributor Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.5 versio

Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.

A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignme

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePat

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API li

A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of t

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attac

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does no

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recal

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to ac

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitize

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking l

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitra

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is

A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a r

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulner

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster i

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal pr

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to byp

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' param

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of t

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of th

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of th

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in al

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cro

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthe

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, rely

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is a

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permission

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read