2026

A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) s

A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password

An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software

The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26

Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Ap

On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptob

This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file

Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential informatio

Stored Cross-Site Scripting (XSS) vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not p

The SIBS woocommerce payment gateway plugin for WordPress is vulnerable to time-based SQL Injection via the ‘referencedI

The All push notification for WP plugin for WordPress is vulnerable to time-based SQL Injection via the 'delete_id' para

The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' para

The Smart Appointment & Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saab_save_form

The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin se

The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in

The WebPurify Profanity Filter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing

The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions

The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a mis

The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via t

The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in

The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa

The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API

The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization i

The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, a

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Karel Elect

If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such m

A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitr

Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an atta

Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an atta

Improper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute pri

Path traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Sam

Improper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL

Improper handling of insufficient permission in Galaxy Wearable installed on non-Samsung Device prior to version 2.2.68

Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attacke

Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with s

Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execut

Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands

Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary act

Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persiste

Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its fun

The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc. Hancom Office 2018, Hancom In

Unrestricted Upload of File with Dangerous Type vulnerability in Hillstone Networks Operation and Maintenance Security G

An arbitrary file overwrite vulnerability in the file import process of Comic Book Reader v1.0.95 allows attackers to ov

A path traversal in Moo Chan Song v4.5.7 allows attackers to cause a Denial of Service (DoS) via writing files to the in

A vulnerability was identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. This affects an unknown

A vulnerability was found in bolo-blog bolo-solo up to 2.6.4. Affected is an unknown function of the file src/main/java/