2026

The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via fo

The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder_img

The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, a

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowin

Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing a

A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php o

billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart

A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in v

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink en

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in th

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Cente

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

Clatter is a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. Vers

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `Async

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by t

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in

vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.

soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mul

vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions,

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.6

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was fo

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `wei

ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-con

Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell end

gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts T

Squidex is an open source headless content management system and content management hub. Versions of the application up

Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may a

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnaly

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-S

pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is pre

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve sta

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Mid

A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain co

Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue a

In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to