2026

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addon

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz A

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Contr

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access C

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table ali

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and

Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scri

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on

This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the sy

ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(p

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a receive

This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functi

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input i

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate aut

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembe

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHe

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backu

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal us

This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option i

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redire

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document bei

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimi

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value b

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a ro

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthen

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notific

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthe

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated conta

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions,

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, all

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level u

The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configurati

The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputt

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requestin

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a le

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, all

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file i

The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on o

VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local