2026

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an obje

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires th

The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pas

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewr

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing t

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it i

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecti

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using i

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it i

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before o

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachabl

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string para

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verifica

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allow

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modi

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowi

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file mana

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has adm

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's curr

When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range

During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress i

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown functio

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown funct

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of

A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown functio

A flaw has been found in TRENDnet Router 1.1.02b01. The affected element is an unknown function of the file /cgi-bin/pin

A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admi

Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Reque

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the op

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the op

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSu

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to vers

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account tak

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted b

This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.

Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification m

Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside

Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker who had compro

Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code ins

Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the rendere

Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code

Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leveraging social

Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code ou