2026

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitiz

Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API key

Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that a

Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that auth

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy

Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file rea

Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch

Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onb

Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy

Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image

capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current r

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table.

Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permis

Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode w

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifi

Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login pat

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API k

ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an orga

ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordina

ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature.

ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profil

ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identit

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero re

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b6

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-s

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling it

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before re

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for c

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers i

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPres

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handle

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that sa

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database back