2026

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing no

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys end

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint t

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user record

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to w

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to

WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eigh

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScri

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows un

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and inclu

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a mi

CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge in

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z arc

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowin

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subus

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, S

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authen

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. A

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unaut

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and exec

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure ar

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and

APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to en

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authentic

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users in

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any a

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skippi

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to creat

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authe

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing auth

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_fo

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortco

The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input be

The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allo

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigat

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX acti

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute