2026

Tanium addressed a SQL injection vulnerability in Patch.

IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1

The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced aft

pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol me

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physica

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versio

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows A

Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackB

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resou

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges an

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM St

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchroni

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that all

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to ar

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to dow

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash th

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arb

Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a netw

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deleti

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache To

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle w

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. Thi

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cl

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching fo

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.E

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerab

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive In

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and includin

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagn

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solu

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. I

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL