2026

Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via

Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authori

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (C

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can

Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiti

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Exces

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can

Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive

Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privile

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A

Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query Sys

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calcu

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-si

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as wel

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input saniti

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter along

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through it

A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vul

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before w

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in th

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users t

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated u

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowin

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes b

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PH

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field version

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Acti

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Men

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functiona

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Sug

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Dig

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF version

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience

Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalati

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carou

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commer

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versi

Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.