2026

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST paramete

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same s

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing

In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host netwo

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions befo

An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By suppl

A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attack

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the applica

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated networ

Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer.

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenti

Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authentic

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoin

A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardco

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and inclu

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning i

The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selec

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a with

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet trans

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handle

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses durin

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintex

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local a

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and  authentication tokens in log fil

The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can

The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when th

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of it

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user c

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, al

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entrop

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on severa

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions availa

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is l

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not esc

A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file

A command injection vulnerability exists in the WebTools administrative interface handling configuration download or fil

An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9

An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines durin

A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanis

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fab

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.