2026

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Atta

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthentic

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT token

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the r

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing cust

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in si

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before renderi

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters,

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” par

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extensio

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned fi

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF toke

When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL ski

A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has

MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited s

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certifi

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN

wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly e

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response s

In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS

Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of th

Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse t

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribu

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership chec

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one o

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation c

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before output

The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handle

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loa

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is per

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destin

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of u

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /web

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the wo

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback re

Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/serv

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0