2026

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users cap

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the req

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up del

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative boo

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of t

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a r

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deser

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX actio

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, al

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options ca

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an imag

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is ent

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of f

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before req

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops

A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCe

A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function

A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Co

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Us

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acqui

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.r

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleF

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead dep

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uni

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malf

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in Sa

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows a

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighl

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the functio

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSet

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allow

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting d

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue oc