2026

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerabilit

Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions.

Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.

Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.

Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.

Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.

Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.

Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.

Administrator SQL Injection in Newsletters <= 4.18 versions.

Administrator SQL Injection in WP Maps <= 4.9.9 versions.

Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Res

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packet

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.d

WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/use

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number genera

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnera

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Element

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Functio

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be int

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Selec

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true.

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before u

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress an

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding o

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputt

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for t

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of sev

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1

Transient DOS while parsing frame during channel usage.

Memory Corruption when validating large data buffers from external sources using addition to check buffer length.

Information Disclosure when a pointer is reused after being deallocated.

Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.

Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.

Memory corruption when processing escape handling flow with insufficient user buffer sizes.