2026

FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate

Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated

Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthent

Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated

ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers t

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attack

Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unaut

DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inj

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthe

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthentic

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unau

TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthen

When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl coul

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the ne

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy ha

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly u

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentatio

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decryp

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was va

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming request

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service ov

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escap

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion err

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text ca

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote()

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd(

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensu

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operat

The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attack

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attack

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes packag

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder

Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnera

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the fil

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th

Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A

Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 fu

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the imp

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change end