2026

a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a loca

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of t

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker us

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters

ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowe

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnera

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side

The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting

The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, an

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10.

Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before

The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and

GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can direct

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report

An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax compone

Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availa

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fa

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are en

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management sol

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search wh

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers o

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configura

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returnin

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a u

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own m

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticate

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progre

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form su

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension v

Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport

mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a documen