2026

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expirat

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rend

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts fil

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/in

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and as

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Managemen

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a

Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server S

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent au

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue

URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data M

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implement

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handle

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its pay

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before pr

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table ro

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expan

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it w

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resou

Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when usin

The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binar

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded P

A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks.

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inc

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask

The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows special

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks r

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and in

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps bloc

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or res

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputti

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager W

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iC

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it i

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a produc

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX acti