2026

Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.

Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Pre

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernet

Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.Thi

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAt

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command a

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerabi

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12,

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPending

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plug

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`),

SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, Dire

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bas

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing att

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted devi

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The G

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unaut

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_

Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14