2026

The Page Title, Description & Open Graph Updater plugin for WordPress is vulnerable to Cross-Site Request Forgery in all

The Country Blocker for AdSense plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,

The Web Accessibility by accessiBe plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions

The Shopire theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to au

The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin inst

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to authorization bypass in versions up to, an

The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0.

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9. This is

The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all version

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limi

The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versi

The Smartsupp – live chat, AI shopping assistant and chatbots plugin for WordPress is vulnerable to Stored Cross-Site Sc

The Printful Integration for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versio

The Mailchimp List Subscribe Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to

The Renden theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, an

The Drift theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and

The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap

The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a miss

The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file

A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted ele

Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input

Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file searc

A vulnerability was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). The affected element is an

A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an u

A weakness has been identified in GoogTech sms-ssm up to e8534c766fd13f5f94c01dab475d75f286918a8d. Affected by this issu

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Co

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authenticati

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc. Cloud Suite and Pri

Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc. Cloud Suite and Privile

A security flaw has been discovered in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6

A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impac

Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit

Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap co

Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of b

Saturn Remote Mouse Server contains a command injection vulnerability that allows unauthenticated attackers to execute a

MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module.