2026

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affec

A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /ap

A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of th

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element i

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerP

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that gene

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails t

A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytag_j

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown cod

A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of t

A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown

A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the f

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown

A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the fil

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_sup

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users cap

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of t

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deser

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX actio

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of f

A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Us

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uni

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malf

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting d

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePres

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowi

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of it

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthe

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an e

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names bef

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the conf

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions u