2026

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5,

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV

The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users to

A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library

An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative p

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used t

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they w

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in al

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves upl

Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UA

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttr

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttr

sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remot

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the han

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the han

free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the han

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transpor

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocit

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands t

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared

Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_lo

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_us

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/view_park

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_ca

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplica

A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the

Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to up

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection vi

Dell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an Improper Privilege Management

The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the

The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitr

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiv

The Prismatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prismatic_encoded' pseudo-short

The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptog

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and includi