2026

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on t

Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website T

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the sam

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allo

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archi

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FIND

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated at

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concre

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The list

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer tru

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization;

SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attac

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows u

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior t

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Explo

MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoin

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authe

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauth

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs owner

MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication,

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wec

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-d

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to re

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parame

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILG

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field b

CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentia

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of t

Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILG

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command inject

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file wr

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through comma

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using e

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using s

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using A

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or over

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspac

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DI

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet admi