2026

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthen

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properl

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validat

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check u

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restric

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity ass

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in use

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied i

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope o

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I. T

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, al

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limit

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rende

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before us

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unkno

A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::_parse_relocations of th

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the fun

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the fu

A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of th

TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, a

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error me

A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unkno

Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexO

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the quer

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows au

A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown fu

A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file

A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue a

A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function Paginatio

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design tha

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary c

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a

A vulnerability was determined in Mstfakts College-Management-System. This affects the function session_start of the fil

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affecte

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build Type