2026

A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the f

Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.

Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allo

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensit

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the clie

A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the f

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This c

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusti

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read a

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a g

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when hand

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider n

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfi

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX

Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attack

Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0

Memory corruption while processing service requests.

Memory Corruption when executing system service routines due to improper handling of user input buffers.

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocat

Transient DOS when processing a continuous receive command with a zero-sized global configuration override.

Memory corruption when processing draw objects of incorrect type during graphics command list execution.

Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsig

Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronizatio

Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronizat

Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.

Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware u

Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.

Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated me

Memory corruption when non-secure loader rewrites page tables before secure memory initialization.