2026

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and includin

OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows

A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacke

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fh' (fingerprint) para

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versi

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL

An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a dire

The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter name

The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up

The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inc

The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all

The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5

The Vagaro Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vagaro_code’ parame

The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to,

Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creati

A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the fu

A vulnerability was found in D-Link DIR-825 and DIR-825R 1.0.5/4.5.1. Affected is the function handler_update_system_tim

Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site wi

Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RC

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32. The flaw exists in the handli

Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows

Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` alw

OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the '

The Blackhole for Bad Bots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent HTTP hea

The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all vers

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the Li

Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelat

Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1

A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32. The application

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace env

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, the NetworkManager role was granted backup

The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme

The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site S

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users.

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authentica

The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an at

The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulne