2026

Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.

Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.

Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider

Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.

Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

Subscriber Broken Access Control in Booked <= 3.0.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be ac

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who h

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a networ

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a

In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc().

Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bi

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patch

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoiste

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value fo

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server

FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege esc

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metada