2026

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administ

A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function us

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.no

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/p

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log messa

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command,

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataF

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.g

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function c

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission

A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts au

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other acc

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitiv

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 retur

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLa

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use

A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability

A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown par

A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompre

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that ca

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections

Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploitin

Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.

Editor SQL Injection in Ultimeter <= 3.0.8 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.

Subscriber SQL Injection in Tainacan <= 1.2.0 versions.

Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.

Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.

Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.

Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.