2026

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended in

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbi

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the int

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intend

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricte

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implem

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - C

SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. Se

Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLE

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Le

Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destin

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial V

Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-o

amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition

Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 vers

Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.

Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checko

Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.