2026

Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.

Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.

Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.

Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.

Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on t

Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website T

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allo

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated at

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer tru

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Explo

MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoin

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authe

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauth

MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication,

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parame

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of t

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical ac

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management s

NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not

AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.js

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updatin

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugi

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in pl

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in th

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerabil

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerabil

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerabil

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerabil

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Be

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to i

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over th

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the pa

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested be

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based ch

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does n

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to

WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerab

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability