2026

Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into inval

pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-contro

Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users wi

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c d

Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.

Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.

Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.

Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.

Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions.

Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list reading with sb_lock i

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which a

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. Durin

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epiphyt Embed Privacy al

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows au

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows

Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.

Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions.

Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component (

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulner

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_i

MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each pass

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds read in dp_get_e

In the Linux kernel, the following vulnerability has been resolved: rust: arm64: set uwtable llvm module flag for CONFI

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool.

Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.