2026

An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (B

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated at

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreer

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() i

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method

telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary J

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, whic

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authent

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server store

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to

The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm al

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attacke

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any aut

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have tw

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an atta

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileg

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) proce

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to caus

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privil

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influenc

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag

An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request para

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is v

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-cre

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed du

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain

Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution

Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulne

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in t

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in t

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in t

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in t

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in t

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in t