2026

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the c

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowin

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauth

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appoi

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter bef

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthentic

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stor

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stor

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a gro

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import f

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allo

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolle

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object I

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit R

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execu

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function Ne

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in variou

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site S

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff acc

A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file

A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of t

A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTabl

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolder

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The D

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without va

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote insta

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships

A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/J

A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFun

A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collect

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiv

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plu

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing u

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that wr