2026

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with decl

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authentic

vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores t

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlist

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the video_fr

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndr

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGalle

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark p

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the li

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the co

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the vi

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a mis

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access li

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMen

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListA

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in t

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in pl

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in pl

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoin

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/a

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/no

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any auth

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and inc

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via m

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server wher

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MA

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively de

Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 v

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic S

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all v

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection v

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a m

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its pr

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists st

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment metho

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when s

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pri

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the s

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a p

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a