2026

OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to ex

The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via th

The REST API TO MiniProgram plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to

The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu

The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and

The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.

The Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3.

The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and

The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0

A security flaw has been discovered in apconw Aix-DB up to 1.2.3. This impacts an unknown function of the file agent/tex

A weakness has been identified in Free5GC 4.1.0. Affected is the function HandleRegistrationComplete of the file interna

A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vuln

A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loadi

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing

The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin f

XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local fi

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/Vie

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/AD_Server/reports.json.p

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at `o

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `getRealIpAddr()` function in `o

Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all use

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an una

OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToD

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, a

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affect

NULL Pointer Dereference vulnerability in tmate-io tmate.This issue affects tmate: before 2.4.0.

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-R

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in m

This issue was addressed with improved input validation. This issue is fixed in iOS 26.3 and iPadOS 26.3. An app may be

A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.4 and iPadOS 26.

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonom

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14

This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sen

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.5, macOS So

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, mac

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Ta

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia

The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP arch

A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software

Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icon

Authentication Bypass by Spoofing vulnerability in Joe Dolson My Tickets my-tickets allows Identity Spoofing.This issue