2026

An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certifica

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control

A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing f

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execu

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooComm

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorre

Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse e

** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vul

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-aft

Apache Allura: stored XSS via SVN code repositories.  Git repositories are not known to be affected.  The vulnerability

Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Crypta

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privilege

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-statu

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify th

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name be

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable director

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Us

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninj

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: thr

Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. U

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in sub

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable locat

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump i

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over H

XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log i

XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sens

XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administ

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listin

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before cre

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC retu

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-o

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ip

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipm

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipm

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireSer

A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-

A vulnerability was found in Eleveo Quality Management 9.7.0. This issue affects some unknown processing of the file /en

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.

A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the compon