2026

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating syst

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object cre

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory.

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting

Authorization Bypass Through User-Controlled Key vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce P

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Sof

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farktor Software E

The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabi

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[].

Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.c

The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows at

When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character stri

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in th

The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Reques

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the publi

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the b

An unauthenticated attacker can exploit this vulnerability by manipulating URL to achieve arbitrary file read access.Thi

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service

The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having a

### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabl

The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely l

JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remo

JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attacke

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized a

Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient P

Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, v

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insuffici

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. Th

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability th

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3,

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 2

The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in iOS 18.7

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5

A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18

This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and i

A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.3 and iPadOS 26.3. An attacker w

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15.

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPad

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in m

A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4,

An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.3. An app may

The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 2

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5

A path handling issue was addressed with improved logic. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.

A package validation issue was addressed by blocking the vulnerable package. This issue is fixed in macOS Tahoe 26.3. An

A logic issue was addressed with improved validation. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5,