2026

The Visa Acceptance Solutions plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and inc

The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3

HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem str

A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validat

An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restric

Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The _make_salt and

The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cr

Deadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone whose authoritative nameserver addr

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS

It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management applic

Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arb

Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic o

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disc

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function tha

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-r

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc

immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open re

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versio

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authoriza

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in in

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior con

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulne

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypasse

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site S

The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event descriptio

The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_i

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauth

The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xco

The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in th

An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 th

NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend

BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. V

nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerabili

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the Live

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subt

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 p

Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerab

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. In versions 1.8.7 and prior, when built w

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-af

Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead

Adobe Framemaker versions 2022.8 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could

Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead

Adobe Framemaker versions 2022.8 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confus