2026

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length o

MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. Th

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_u

A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unk

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_ven

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refu

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic I

MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes v

MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. T

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list.

A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of

A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the f

A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_a

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary s

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerabi

A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password o

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obt

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation cre

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerabil

LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information c

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and C

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hin

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The leng

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the in

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 a

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar –

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-C

Privilege escalation due to weak configuration while temporary file handling.

Privilege escalation due to weak configuration during package extraction process.

Memory corruption while processing a crafted ELF file in the Primary Bootloader.

Exposed dangerous function lead to privilege escalation via gRPC server.

Improper authorization leads to Remote Code Execution via SocketIO interface.

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inc

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCo

The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose passwor

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client c

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote atta

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated atta

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vu

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privile

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty'