2026

OpenEMR is a free and open source electronic health records and medical practice management application. In versions up

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allo

The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client s

Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tick

Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue aff

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allo

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated use

Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer.

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web

Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processin

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KNOWHY Adva

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology

The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, an

PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the sa

PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can injec

PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software I

Omega-PSIR is vulnerable to Reflected XSS via the lang parameter. An attacker can craft a malicious URL that, when opene

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in John

The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and inclu

The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of t

The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives

The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all ve

The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute

An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via craft

Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows

Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Joh

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD al

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD al

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Cont

An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromis

An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or ma

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the conf

IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can vi

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerabilit

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerabi

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permi

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or ins

A weakness has been identified in SourceCodester Doctor Appointment System 1.0. Affected by this issue is some unknown f

Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.

The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p

The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via th

The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This i