2026

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with

A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dyn

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper h

A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient vali

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient val

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially cra

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure per

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malici

The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows special

Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted P

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient

When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attribut

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations throug

When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition invo

When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional conte

Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and relate

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks r

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (ver

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSens

Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildS

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and in

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps bloc

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or res

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX acti

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to ev

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputti

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager W

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iC

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment action

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it i

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a produc

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX acti

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who cre

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before ru

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flip

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its RES

The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility chec

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, all

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, all

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its R

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before crea

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding the