2026

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table fr

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAli

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.

A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multica

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the

To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer

The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first

The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did n

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load A

On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Pas

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing a

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually bee

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allo

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, all

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allo

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX ac

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising t

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on tw

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its mult

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated requ

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allow

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewS

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized acc

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Medi

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Sec

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Publi

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfa

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by h

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 p

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containin

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until versi

CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundatio

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From

An improper input validation vulnerability in the configuration service for processing encrypted credential data has bee

Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web or

Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker

Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromi

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions