2026

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfig

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implement

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unautho

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vu

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vu

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects

The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in

A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends oth

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handle

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its pay

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its A

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before pr

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table ro

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expan

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it w

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/setti

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings fro

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero prot

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resou

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue af

Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when usin

The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binar

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (U

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This v

An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce

A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Und

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant pag

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded P

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation del

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which l

A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download a

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate v

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient valida

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper valid

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inc

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can t