2026

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can inter

An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The cli

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) with

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verifica

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints ar

HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish conn

The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' para

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorizatio

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7

The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.

The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to St

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorizatio

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Sto

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all v

The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, an

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' param

The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a t

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or non

The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a c

The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a

The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing a

The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and

The SEO Booster plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_field' parameter in all versio

The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versio

The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflec

The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-S

The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and includin

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting

The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scrip

The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generi

The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress i

A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is a

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scrap

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js use

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use r

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerabilit

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerabil

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Serv

Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a cra

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscrib

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with vali