2026

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allow

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient vali

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assig

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modific

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shor

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cr

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers

NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to i

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. A

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary commu

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from

A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2

Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woo

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /car

A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file

A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query

A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown fun

A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/

A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txt

A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function Tr

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/M

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDe

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated at

Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacke

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated att

SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functional

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c

SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious in

Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing aut

In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed prof

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant th

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of vis

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administra

In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email

In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccess

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteb

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app imp

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders a

In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved se

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible