2026

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves acr

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized wh

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not N

FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allow

APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthe

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outs

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA in

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on man

Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromis

Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineeri

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rend

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code ins

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a me

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDo

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated a

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's region

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without es

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap con

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fix

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-y

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code e

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenti

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handle

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote c

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site R

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthen

A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An una

Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauthentica

A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation co

Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access