2026

The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed

gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 unti

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticat

A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build

Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a partici

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElem

Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Syste

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls F

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attac

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with frien

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with frien

LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thr

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal config

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of intern

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, un

The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's bef

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing

HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to re

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User

Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensiti

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection ma

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker wi

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access

The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the

The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoi

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attemp

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Wor

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is respo

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a gr

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoin

The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allo

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning supp

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 throug

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of i

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor re

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the target