2026

Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<ap

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Dis

The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftp

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web User

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespa

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the Change Customer modal expose

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Pr

A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d. Affected is the function log_login of the file cor

A vulnerability was identified in Sanluan PublicCMS up to 6.202506.d. Affected by this vulnerability is the function Zip

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacke

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/

The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in

The Kcaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.1.

The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ

The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up

The TextP2P Texting Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and in

The DX Unanswered Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i

The mCatFilter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.5.

The Ni WooCommerce Order Export plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to a

The Google PageRank Display plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and inclu

The Fast & Fancy Filter – 3F plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and incl

The Emailchef plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affect

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed

A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token

Missing Authorization vulnerability in Navneil Naicker ACF Galerie 4 allows Exploiting Incorrectly Configured Access Con

OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows tru

OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin auth

OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to

In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/log

Xibo is an open source digital signage platform with a web content management system and Windows display player software

The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This

The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information

The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3.

The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and Task

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at le

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded,

A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1. This issue affects the function updateStoryboardUrl

A security vulnerability has been detected in code-projects Home Service System 1.0. The impacted element is an unknown

A vulnerability was identified in code-projects Employee Management System 1.0. This affects an unknown part of the file

A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. This affects an unknown funct

A security flaw has been discovered in code-projects Employee Management System 1.0. This issue affects some unknown pro

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function

An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to

A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a dire

A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0. This impacts an unknown functi