2026

Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elemento

Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote C

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project ad

Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on do

Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor

Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin back

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The

Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most

Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly

Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are dire

SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects t

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated record

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push.

MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accept

MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity.

A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/c

A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file

A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the fi

A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_han

在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_nod

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data o

A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a2

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Th

A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0

A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013

在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-s

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status co

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, a

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does no

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its conf

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually c

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 s

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook

The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes bef

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's con

A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f3

A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c0

A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processi

The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-am

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-st

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected Woo

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt ex