2026

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rend

Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption v

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed

Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authori

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can

Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiti

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Exces

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can

Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A

Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query Sys

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calcu

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-si

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input saniti

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter along

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing

A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vul

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before w

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users t

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated u

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes b

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field version

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Acti

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Men

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Sug

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Dig

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF version

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carou

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versi

Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.

Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versi

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This

Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Brow

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality

Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Cont

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint

Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team c