2026

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environ

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Stat

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_

A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of th

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Transla

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite in

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the f

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputti

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST

A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functi

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, bef

A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /t

A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /custo

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API toke

A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /custo

LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allow

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only s

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by sup

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON fi

W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality N

OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modi

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy se

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that a

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control

OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to in

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock le

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) i

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ra

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on