2026

Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.

Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.

MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph previe

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functio

A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file fun

Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.

Contributor Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.5 versio

Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Cont

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted in

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cry

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged loca

A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main head

A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignme

Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its c

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This is

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePat

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API li

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affecte

A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of t

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-a

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concu

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access t

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission su

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site