2026

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter i

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to S

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of t

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log lev

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 thro

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensit

A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/comp

A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown funct

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in us

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate t

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated e

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includ

A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component St

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url en

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vu

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widg

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetch

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by una

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFa

A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the fi

A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of t

A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the f

Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them int

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in

The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGE

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team obje

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, a

A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permission

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured wi

Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because th

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1

IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoi

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function Authorizat

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the f

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7,

This issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app ma

A permissions issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequ

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be a

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS G

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in m

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. M