2026

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/depa

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in white

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fail

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller t

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plain

A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevo

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process

A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of th

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SS

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up del

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative boo

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a r

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, al

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an imag

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before req

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops

A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCe

A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Co

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acqui

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleF

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead dep

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows a

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the functio

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSet

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue oc

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a stri

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all version

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi

The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' paramete

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple A

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptograph

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. T