2026

Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.

Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.

boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints r

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticat

Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an att

Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the f

Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.

Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools <= 1.2.2 versions.

Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return valu

Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-rev

Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.

Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability t

In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-accoun

iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or aband

iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies tra

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigg

iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malic

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authenti

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of t

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value i

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Con

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Cap

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ul

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Ret

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrie

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templa

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Ac

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metf

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements

Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Sit

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essent

Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-fo

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploit