2026

Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac

Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack

An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE

Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote

WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authen

WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An auth

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed)

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper t

A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the

Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote

Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.

Contributor Broken Access Control in WpEvently <= 5.5.0 versions.

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer

Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.

Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ceviz Informatics

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Dayneks Software I

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Sof

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' confi

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript v

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site na

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes l

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests fro

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fi

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the N

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where cr

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs w

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_s

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing at

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolut

A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing.

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression st

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to b

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentica

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more tha

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin i

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal ha