2026

Memory corruption while processing a crafted ELF file in the Primary Bootloader.

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vu

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution

The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5.

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumula

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and i

The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorizatio

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization chec

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' param

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputti

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Bl

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routi

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard

SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craf

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests cr

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticat

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows aut

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote

Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitte

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker t

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-cont

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2

The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-process

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is

A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specia

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.

CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of va

An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/

A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under th

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox ho

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and aut

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document impor