2026

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is c

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for t

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of sev

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to,

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The

Transient DOS while parsing frame during channel usage.

Memory Corruption when validating large data buffers from external sources using addition to check buffer length.

Information Disclosure when a pointer is reused after being deallocated.

Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.

Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.

Memory corruption when processing escape handling flow with insufficient user buffer sizes.

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copyi

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Memory corruption while processing rear sensor IOCTL calls.

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enab

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper sy

Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operat

Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.

Memory Corruption when copying large input data exceeds normal allocation limits.

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the applicat

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scrip

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versi

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or

The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when pa

A remote attacker who controls a container registry may be able to direct a client's token request to a host of the atta

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression de

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain

Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a commen

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows re

Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAcc

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fi

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirec

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun c

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields

Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endp

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relativ

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the se

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the

AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticat

AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate