2026

Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKi

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspectio

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations whe

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unau

Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacke

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could i

MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a

A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on t

A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numb

A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing un

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate

Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apa

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.

Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unm

Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP s

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUr

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Func

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emit

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetchi

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service.

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated memb

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions fro

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that all

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that a

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functio

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to lo

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows

Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-priv

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpo

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers t

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview featur

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attacke

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauth

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to acce

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site membe

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactiv

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stri

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results e

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote att