2026

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes b

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the str

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Ap

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actua

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESM

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an emp

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is conf

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one au

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list o

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exch

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication co

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party admin

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface

A routing rule selects between two different authentication mechanisms for the same downstream service based on the valu

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path o

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without valid

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate e

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClie

OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A us

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's vali

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoin

matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matri

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the po

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::s

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_templ

A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concret

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, custom

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, custom

A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated

Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.

Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 vers

Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.

Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.