2026

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership

Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are mi

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template const

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incomi

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-sid

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPubl

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlug

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authenticatio

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missin

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and

art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and ext

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _cr

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes agai

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded

The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only cl

imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is posit

imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * rat

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification a

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_pol

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netde

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before readin

In the Linux kernel, the following vulnerability has been resolved: gtp: check skb_pull_data() return in gtp1u_send_ech

In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update e

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on a

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsol_bcast_probe_resp double f

In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries th

** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy:

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a siz

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These token

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability ch

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable,

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist i

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDe

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail genera

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated att

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of