2026

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin val

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of t

The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all version

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state c

The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, re

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism,

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some o

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJ

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor docu

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Secon

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQ

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQ

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind S

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Sc

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versi

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' paramete

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` par

In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Se

A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could downloa

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker

A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Uni

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When a

A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO)

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another projec

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due t

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to c

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due t

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due t

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due t

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant exec

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards call

An improper access control vulnerability exists where an authenticated non-administrative application user could potenti

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effec

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbit

A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work tim

The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fra

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.t

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_m

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSF

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function sa

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vul