2026

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does n

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite oper

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypa

A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a pa

WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerab

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unau

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerabili

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerabi

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. U

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset e

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shor

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attribut

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not inc

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job,

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoint

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value be

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a sit

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed eleme

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside a

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allo

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attack

A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attac

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce chec

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce chec

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authentica

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks bef

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a cl

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating th

An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .ver

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where t

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a manag

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnera

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect

PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF su

PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.

PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a

PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF da