2026

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled

DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious us

DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious us

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the inten

DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio P

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Pho

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundh

Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Member

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks

Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configu

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv all

Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sens

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. A

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An att

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configura

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. A

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce

Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium A

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force P

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force S

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented de

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with n

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call

A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file

A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/met

A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the f

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unkno

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain

A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of th

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the fi

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of t

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files containe

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/h

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actua

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a custom

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-a

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issu

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occu

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin