2026

Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tH

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page e

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows un

Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in t

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/s

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddin

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint tha

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable fu

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints search

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attacker

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that fo

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth hand

SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-se

SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-acces

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows reader

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows una

Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive

Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software I

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library ca

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a rout

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip di

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 throug

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12

Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Secur

A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disable

MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOr

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protoco

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schem

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of pa

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its RE

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check fo

fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-fou

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart al

Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resource leak exposure. Th

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite la