2026

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts

Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trig

Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.

Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.

Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up t

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152

Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 14

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The sup

Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control S

The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `e

Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint

markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer:

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security desc

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, re

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitiv

The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4

The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac

Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oa

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due

Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, a

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id

Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in t

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function wi

The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of b

The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and

The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all version

There is a memory leak in NI grpc-device BeginSidebandStream that may result in denial of service due to memory exhausti

The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up t

YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing informa

Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metri

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows

Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint t

A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bu

The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account v