2026

PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with acc

The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missi

The Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor plugin for WordPress is vulnerable to ar

A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records t

OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and

Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to

HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ce

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypas

Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An au

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage me

The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, al

Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in t

A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code exec

Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset

HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-dele

Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Pl

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Pr

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported vers

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a

Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Pl

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Rel

Vulnerability in the Oracle Life Sciences Central Coding product of Oracle Health Sciences Applications (component: Plat

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and re

GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can cra

EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and belo

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18,

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.4, 18.7 before 18.7.2, and 1

The Infotainment ECU manufactured by Bosch which is installed in Nissan Leaf ZE1 – 2020 uses a Redbend service for over-

A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Comp

Missing Authorization vulnerability in Jthemes xSmart xsmart allows Exploiting Incorrectly Configured Access Control Sec

Missing Authorization vulnerability in Ninetheme Electron electron allows Exploiting Incorrectly Configured Access Contr

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand R

Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Conf

Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking

Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly

Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Confi

Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows

Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Inco

Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Pro

Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-fo

Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-fo

Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Ac