2026

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Functio

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability

Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing.

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be int

A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an un

In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A l

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algori

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Selec

A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target Loo

For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving anoth

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding

Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticke

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense d

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense.

Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control S

The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate t

The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate t

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense.

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insu

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before u

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress an

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecu

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payme

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX actio

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the

The Active Woot Products Tables for WooCommerce. 100% FREE  WordPress plugin before 2.1.3 does not have authorisation an

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unaut

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported b

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely,

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding o

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderat

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputt

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy a

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the s

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, m

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is on