2026

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is per

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destin

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of u

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin

Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/serv

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowin

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backen

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that all

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nod

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derive

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allow

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSO

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (clien

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHand

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume fe

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP

Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configure

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification,

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command t

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET r

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDoma

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, all

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each c

Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser)

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/f

Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the option

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpol

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media t

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does no

GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodu

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table update

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who kn

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file loc