2026

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown fun

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handleb

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching lan

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.def

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-b

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-chec

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improp

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an impro

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper p

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-ch

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown func

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary J

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administ

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authentica

A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP

n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git no

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. Whe

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. W

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's protot

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resour

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completi

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-s

Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.

Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.

Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.

Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.

Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.

Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.

Subscriber Broken Authentication in Leyka <= 3.32.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker b

Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.

Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.

Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.

Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.

Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.

Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.