2026

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Un

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 vers

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.

Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

Subscriber Path Traversal in Do Lasso <= 358 versions.

Subscriber SQL Injection in Do Lasso <= 358 versions.

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics

Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as p

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrar

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system u

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the oper

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing ar

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hosti

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT p

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to under

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as t

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a cal

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter th

JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.i

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that ca

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fail

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing atta

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handl

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing