2026

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of pa

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check fo

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart al

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorre

** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vul

Apache Allura: stored XSS via SVN code repositories.  Git repositories are not known to be affected.  The vulnerability

Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Crypta

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-statu

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name be

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable director

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninj

Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. U

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in sub

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable locat

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump i

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over H

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before cre

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireSer

A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-

A vulnerability was found in Eleveo Quality Management 9.7.0. This issue affects some unknown processing of the file /en

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functional

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote

A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f6138

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a061

Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue affects rLottie: 256

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowin

MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a N

MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of th

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket owners

IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validati

IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages

IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validati

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE)

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject.

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior

Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker lever

Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY p

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing

A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addw