2026

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the na

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Cont

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-sup

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Cont

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.2

The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template ren

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-clie

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore pa

Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with

Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromis

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflo

A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetVa

A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewa

A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the fil

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown funct

A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown functi

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown f

A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unk

A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects

A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affe

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulat

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affec

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name s

The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, p

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total ar

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming paymen

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the s

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record b

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking durat

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected co

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-base

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications,

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payme

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to b

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issue