2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support G

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms al

Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Inj

Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Sc

Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Priv

Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This i

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrect

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore

Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Inject

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0

The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check a

A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of th

A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management action

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before r

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the tar

The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks b

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staf

The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching i

The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles ma

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role fr

The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renamin

The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site be

A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::outpu

A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown func

A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.ph

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.

A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c991

A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e244

A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a

A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endp

ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) v

A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pu

A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the fun

A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the fu

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmos

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration v

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML inject

Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gR

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/po

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostnam

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest h