2026

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one o

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the a

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using i

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before o

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creati

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest che

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown pro

There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can explo

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system whe

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux sys

A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected ele

A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf7

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Th

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpo

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MO

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affecte

A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/st

A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the

An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SA

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, au

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read o

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection ext

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundati

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to valida

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when alloca

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in dr

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailC

An authenticated user with edit permission on one folder can move a library panel into another folder where they only ha

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config

mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in valid

Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privile

KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On.

A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated

A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authentica

A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Succ

An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated