2026

A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Exp

A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customer

A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /mo

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when renderin

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPr

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same a

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions

A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /mod

A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown f

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boa

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of t

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the f

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file

A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the

A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function o

A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi

A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of th

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the fil

A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-

A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetC

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the f

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited chara

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never att

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificat

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user

An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via bac

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zer

libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instructio

libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular unco

rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received fro

The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its heade

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit i

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and ad

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where t

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing an