2026

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testi

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visit

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before discl

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket att

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method b

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift ca

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9.

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking tar

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post bef

An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a

An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Ds

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and C

Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers

Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with S

Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to ac

Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory.

Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local at

Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to ex

Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with syste

Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code wi

Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potenti

Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive i

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connect

Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers

Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write

Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system s

Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to a

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affec

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affec

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availa

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallba

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishan

Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affec

Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affec

Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all vers

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to