2026

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Matterm

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, r

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_writ

An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Serv

Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remo

Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows auth

A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse

Subscriber Broken Access Control in Bookify <= 1.1.1 versions.

Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.

Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.

Subscriber Broken Access Control in Motors < 1.4.107 versions.

Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.

Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.

Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.

Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.

Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.

Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.

Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.

Subscriber Broken Access Control in myCred <= 3.0.3 versions.

Subscriber Broken Access Control in Amelia <= 2.2 versions.

Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions.

Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.

Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.

Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.

Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.

Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.

Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions.

Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.

Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.

Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.

Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.

Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.

Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.

Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.

Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.

Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.

Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.

Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 Thi

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Contro

Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.

Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firef

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152