2026

The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in

The Same Category Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget title placehold

The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capabi

The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1

The JustClick registration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, a

The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in

The VK Google Job Posting Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Descript

C++ HTTP Server is an HTTP/1.1 server built to handle client connections and serve HTTP requests. Versions 1.0 and below

phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly e

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlatta

A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a wr

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Vers

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Vers

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Vers

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Vers

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Vers

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Vers

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Vers

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In v

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In v

ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malic

Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Pr

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, For

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing

Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae4

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignme

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard aga

Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.2

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-mi

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Sc

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the DomainCheckerApp class within domain/script.js of Sou

A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/up

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on L

An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend

An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backen

A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testin

A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to t

A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers

An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pr

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access

Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data

Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to

The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when seria

LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package crea

A reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary