2026

Contributor Local File Inclusion in Vino <= 1.9 versions.

Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.

Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

Contributor SQL Injection in MapSVG <= 8.14.0 versions.

Contributor SQL Injection in MapSVG <= 8.14.0 versions.

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via develop

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configur

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tool

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configur

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-loca

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-loca

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules

Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.

Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.

Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.

Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.

Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.

Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.

Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailP

Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.

Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

Contributor SQL Injection in eRoom <= 1.7.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'All

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network b

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - T

Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extensio