2026

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.

Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.

Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.

Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.

Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.

Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimp

Contributor Broken Access Control in WSP MCP &#8211; AI Agents Connector <= 2.7.0 versions.

Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(Str

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths.

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated use

/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_

JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions()

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompleti

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of he

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authenticati

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the ru

Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabiliti

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regener

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses v

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an atta

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can i

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, a

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in Pg

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowin

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values refere

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/contro

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller e

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutra

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rul

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalatio

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensi

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values f

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate requ

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, a

If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSes

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjec

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validat