2026

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Functio

Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing.

A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an un

A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target Loo

The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate t

The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate t

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecu

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payme

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX actio

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the

The Active Woot Products Tables for WooCommerce. 100% FREE  WordPress plugin before 2.1.3 does not have authorisation an

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unaut

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported b

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy a

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the s

Memory corruption while processing rear sensor IOCTL calls.

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the applicat

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scrip

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versi

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain

Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a commen

Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAcc

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields

Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endp

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relativ

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the se

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the

AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticat

AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate

In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowin

In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without

TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low En

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransp

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary marku

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing una

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints,

PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allo

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authentica

LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated acc

kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent document

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticate

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper t