2026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gall

Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Config

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exp

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Mas

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator W

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vit

Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configur

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPi

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait

Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-o

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Tra

Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trad

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unau

Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. Th

Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2

Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6

Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadr

Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 throu

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3

Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer

Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive

Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated a

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a loca

Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an au

heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is us

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is posit

The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before cr

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger wh

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX r

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local in

Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progr

The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacke

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who ca

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notificati

Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToStri

Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressi

An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.

In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment confi

Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attr

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account in

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes co

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data so

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions i

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized oper

A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process