2026

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before re

The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feat

The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves f

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-t

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL stat

The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can u

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, an

A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_q

A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the fi

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemot

Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every ca

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthentic

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allo

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint tha

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authe

1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowin

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule ha

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated c

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accoun

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server fil

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscrip

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldControll

mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to de

mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other sh

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write in

Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler t

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send templa

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiCo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiControl

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-pri

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles ha

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handle

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that a

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler t

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGeneration

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP se

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsCo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeC

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin ha

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsControl

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that a

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler t

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler th

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to