2026

The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admi

Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to a

A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was

Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacke

UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability.

Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login

Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attack

In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames th

In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of u

The Vantage theme for WordPress is vulnerable to Stored Cross-Site Scripting via Gallery block text content in versions

The CodeColorer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in 'cc' comm

The WP Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdocs_options[icon_size]' parame

MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers

MailGates/MailAudit developed by Openfind has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remo

The  iSherlock developed by HGiga  has an OS Command Injection vulnerability, allowing unauthenticated local attackers t

WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local

radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a loca

An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privi

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI esca

Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows

The WP YouTube Lyte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lyte' shortcode

Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as s

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat a

OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with cha

Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery

The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPres

Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and belo

maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the au

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePres

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and m

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.

Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 throug

A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an

Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interf

Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface componen

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection

ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included i

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection

Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential d

Barracuda RMM versions prior to 2025.2.2 contain a privilege escalation vulnerability that allows local attackers to gai

A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/

A flaw was found in gimp. This buffer overflow vulnerability in the GIF image loading component's `ReadJeffsImage` funct

Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sens

Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bo