2026

Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.

Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.

Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embe

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for re

Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP r

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the ch

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protecte

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's ex

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-l

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate p

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependenci

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagin

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions be

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depNam

Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0

Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts b

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header whe

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing mal

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11,

Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v

Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx pr

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugi

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive u

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream p

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in th

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request f

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-si

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.

Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase Postg

capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested r

Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-i

Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving st

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath o

A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network prox

ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to cras