2026

An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to netwo

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary

Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication

Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condit

Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to laun

Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on at

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to cha

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repos

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with rea

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a

Gitea does not properly validate project ownership in organization project operations. A user with project write access

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachmen

An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repos

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sani

A low-privileged user can bypass account credentials without confirming the user's current authentication state, which m

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally con

The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvi

Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.1

Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.1

Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. An unauthenticated attac

A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality o

An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation.

An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery P

Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configur

Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting

Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allo

Cross-Site Request Forgery (CSRF) vulnerability in launchinteractive Merge + Minify + Refresh merge-minify-refresh allow

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider

Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This i

Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incor

Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploit

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-p

Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-sub

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorre

Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Securit

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Travele

Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows

Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager all

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPre

Server-Side Request Forgery (SSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Inc

Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured A

Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez