2026

LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administr

PDW File Browser version 1.3 contains stored and reflected cross-site scripting vulnerabilities that allow authenticated

The WP Google Ad Manager Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in

The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

The Vzaar Media Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, a

The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in

The imwptip plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site

The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec

The Recooty – Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version

The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin

The SEO Links Interlinking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_error' p

The Order Minimum/Maximum Amount Limits for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scriptin

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin s

The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct O

The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.

When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of

Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents

The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and

The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The Forms Bridge – Infinite integrations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id'

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due

The WPBITS Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget pa

The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_na

The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress is vulnerable to Stored Cross

The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via fo

The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder_img

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowin

Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing a

billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in v

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in

vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.

gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts T

Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-S

pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is pre

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve sta

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Mid

Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue a