2026

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/aut

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats

Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, D

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive p

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload i

Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementat

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list r

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, B

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fa

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonica

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config f

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attacker

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerabi

CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to p

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim co

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/sr

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox a

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames cor

CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula chara

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (age

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: fro

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site R

Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.