2026

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gosoft Software In

Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to ac

Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to cr

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subseque

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allo

Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affe

Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve inf

A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corrupti

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elem

Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Secur

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incor

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs Happy Addons for Elem

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Co

Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGr

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMart Team Member

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorr

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Log

Improper restriction of excessive authentication attempts vulnerability in Hitachi Virtual Storage Platform G130, G150,

Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage

A low privileged remote attacker can gain the root password due to improper removal of sensitive information before stor

Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched enc

ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM

OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One B

An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When

The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress

The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_

The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the `get_current_letter_docs` and `docs_sort_

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applica

Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a Requ

YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerabi

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0.

Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.

Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close o

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_m

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom

Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modu

Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio SAML Identity Provider implement