2026

A vulnerability has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /che

A vulnerability has been found in code-projects Simple ChatBox up to 1.0. Affected by this vulnerability is an unknown f

The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could resul

Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in a

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated S

A vulnerability was found in aandrew-me ytDownloader up to 3.20.2. Affected by this issue is the function createTextNode

The Material Master application does not enforce authorization checks for authenticated users when executing reports, re

Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Structures), an attacker c

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and be

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

The Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to u

A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR P

A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application us

CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log tru

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to p

Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a

The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cr

The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8.

Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured

Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Conf

Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured A

Cross-Site Request Forgery (CSRF) vulnerability in DeluxeThemes Userpro userpro allows Cross Site Request Forgery.This i

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.26

Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cro

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote att

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpo

Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially se

Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out o

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePres

In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames th

Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie d

The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due

The cms-fuer-motorrad-werkstaetten plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to an

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5,

A flaw has been found in Qihui jtbc5 CMS 5.0.3.6. Affected is an unknown function of the file /dev/code/common/diplomat/

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint (PATC

A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub_401F80 of the file /cgi-bin/l

A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the compone

A security vulnerability has been detected in ComfyUI up to 0.13.0. This affects the function create_origin_only_middlew

A vulnerability was detected in ComfyUI up to 0.13.0. This impacts the function get_model_preview of the file app/model_

A flaw has been found in ComfyUI up to 0.13.0. Affected is the function folder_paths.get_annotated_filepath of the file

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function cre

A vulnerability has been found in Lagom WHMCS Template up to 2.4.2. This impacts an unknown function of the component Da

A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bu

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated us

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Di