2026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inser

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Con

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-e

A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a m

A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Perf

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php.

A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the c

Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly C

Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhispe

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-liv

Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allo

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calcul

Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly

The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from e

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser ba

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authent

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is d

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remot

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to refe

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the app

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Requ

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services com

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processin

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code o

A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This a

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple sched_cache_group from mm to

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it,

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order ma

SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to

A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. A

A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected b

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fw

A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the

A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /syste

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of it

An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The dom

A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vul

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers

Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to inst

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privi

Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore p

Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive informa

Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive informat