2026

The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized m

The PDF Resume Parser plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in

The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. Th

The Testimonials Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version

The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, an

The Makesweat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'makesweat_clubid' setting in al

The SpiceForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spiceforms' short

The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users mac

Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulner

Multi-thread race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vuln

Double free vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affe

Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability

Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect

Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect

Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect a

Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may af

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulner

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulner

Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnera

Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulner

Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerab

Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerab

Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerab

Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnera

The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-

The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-

The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-

The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sa

A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration

Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to

WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by mani

Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS comman

Tftpd32 SE 4.60 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbit

Sysax Multi Server 6.95 contains a denial of service vulnerability in the administrative password field that allows atta

Mediconta 3.7.27 contains an unquoted service path vulnerability in the servermedicontservice that allows local users to

eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by ma

Explorer32++ 1.3.5.531 contains a buffer overflow vulnerability in Structured Exception Handler (SEH) records that allow

Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attac

Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject ma

Outline 1.6.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitra

Inbit Messenger versions 4.6.0 to 4.9.0 contain a remote stack-based buffer overflow vulnerability that allows unauthent

Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to

AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes appl

Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attacker

Clevo HotKey Clipboard 2.1.0.6 contains an unquoted service path vulnerability in the HKClipSvc service that allows loca

e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to overrid

CONTPAQi AdminPAQ 14.0.0 contains an unquoted service path vulnerability in the AppKeyLicenseServer service running with

Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for exte

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload mal