2026

The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target tax

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, rely

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded th

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is a

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attack

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permission

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits in

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one o

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildc

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the a

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sani

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using i

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before o

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving s

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload ac

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creati

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest che

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown f

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthent

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote atta

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown pro

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of t

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stor

There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can explo

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementati

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementat

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API w

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementati

Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remot

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a ma

Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malici

Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote att

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system whe

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux sys