2026

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating

There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited pri

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses ali

Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.

Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.

Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.

Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.

Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore &amp; Migration <= 2.4.2 versions.

Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.

Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.

Missing Authorization vulnerability in WP Swings Return Refund and Exchange For WooCommerce woo-refund-and-exchange-lite

Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Passw

Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter &#8211; Lite <= 1.2.3 versions.

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced P

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions.

Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects

Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP r

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protecte

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-l

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate p

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependenci

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagin

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions be

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depNam

Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts b

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header whe

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing mal

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11,

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugi

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream p

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in th

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-si

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.

capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested r

Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-i

Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time

A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network prox