2026

The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date_from' and 'date

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_sa

The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1

The Hammas Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'apix' parameter in the 'h

The MDJM Event Management plugin for WordPress is vulnerable to unauthorized data modification due to a missing capabili

The ZIP Code Based Content Protection plugin for WordPress is vulnerable to SQL Injection in all versions up to, and inc

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a stored cross-site scripting vulnerabil

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnera

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a missing authentication vulnerability i

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Referenc

The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized mod

The WP Frontend Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl

Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate work

Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/seri

Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDept

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, a

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, a

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta t

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo cou

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the

When verifying a certificate chain which contains a certificate containing multiple email address constraints which shar

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization fl

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication c

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not r

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentica

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.

Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environmen

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.3

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Pri

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigati

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publicatio

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication e

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forg

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Ref

A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a38

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Po

A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbb

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF b

GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed

GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary wi