2026

Gumbo CMS 0.99 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL qu

Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensi

Data Center Audit 2.6.2 contains a cross-site request forgery vulnerability that allows attackers to reset administrator

Alive Parish 2.0.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQ

Alienor Web Libre 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary

ABC ERP 0.6.4 contains a cross-site request forgery vulnerability that allows attackers to modify administrator credenti

Rmedia SMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database informa

Pedidos 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queri

EdTv 2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by

DoceboLMS 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queri

AMPPS 2.7 contains a denial of service vulnerability that allows remote attackers to crash the service by sending malfor

Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers t

Net-Billetterie 2.9 contains an SQL injection vulnerability in the login parameter of login.inc.php that allows unauthen

Meneame English Pligg 5.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit

Galaxy Forces MMORPG 0.5.8 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitr

EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive

BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queri

2-Plan Team 1.0.4 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload executab

Warranty Tracking System 11.06.3 contains an SQL injection vulnerability that allows attackers to execute arbitrary SQL

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This

Missing Authorization vulnerability in Rank Math Rank Math SEO PRO allows Exploiting Incorrectly Configured Access Contr

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pascal Birc

QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, w

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allo

An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configur

The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflect

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileac

An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelis

SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version

SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directl

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Pr

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to vers

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, there is a stack b

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerabili

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cach

HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identifi

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected c

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability

Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, p

Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code cont

Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Disco

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-f

OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze,

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify t

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action,

The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could al