2026

Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc

Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' p

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's paren

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level u

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, an

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authenticati

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing befor

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it in

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticate

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site S

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating i

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection act

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Script

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all version

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before stori

The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Sc

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitra

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecogn

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown functi

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown functi

Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent over HTTP rather th

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineer

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered,

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection w

ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata hand

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allow

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePee

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated rem

Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the f

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-sit

- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This i

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects Ea

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive

: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abus

- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middl