2026

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modific

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shor

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all ver

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cr

Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux,

The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This issue

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data th

In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passe

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configu

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers

NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to i

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. A

Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Con

OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container

A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary commu

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or m

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained i

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to genera

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web inte

A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2

A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control P

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All

Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.

Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. Th

Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments

Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woo

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting I

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import fun

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affec

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Compon

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issu

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /car

A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file

A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query

A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown fun

A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/

A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txt

A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function Tr

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/M