2026

Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting In

Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Conf

Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF toke

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Boun

The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_container' attr

The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.

The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [p

The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode a

The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8.

The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of t

The WP Circliful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of t

The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and includi

The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including

The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3

The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cr

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS

Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arb

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disc

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-r

immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open re

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versio

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authoriza

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in in

The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event descriptio

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauth

The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in th

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability

Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead

Adobe Framemaker versions 2022.8 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could

Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains

Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.7

Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralizati

Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a store

Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions

The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization check

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting

October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cros

October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-

Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vuln

Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vuln

Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vuln

Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to i

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. I

Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to p

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.