2026

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Data Mover). Supported

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PeopleCode). Supported

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The support

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported ve

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authenticatio

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment

Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations). Supported ve

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Support

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported v

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Obj

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (comp

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (comp

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics W

Vulnerability in the Oracle HRMS (Netherlands) product of Oracle E-Business Suite (component: Netherlands Payroll). Sup

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allow

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using i

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored C

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthentica

Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery (SSRF) vulnerability. An una

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Privilege Management vulnerability. A high pri

Dell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an Improper Neutralization of Special Elements used in a

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded throug

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to ac

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administ

Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability all

Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allow

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that al

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Tex

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly ch

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the target

Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack

The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrator