2026

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by send

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by send

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by send

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sendi

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/aj

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_param

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_i

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_paramete

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_ta

A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload end

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage en

A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info

An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an adm

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 1

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission aga

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is appli

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 1

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 1

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress s

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 1

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted throu

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 1

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a diff

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges bef

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user th

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauth

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints tha

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that c

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-upda

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration befo

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied pos

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serv

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative templa

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute