2026

TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the cl

PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and all

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's i

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Tra

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import sign

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but d

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derive

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom U

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclu

By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow

Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary

Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against int

Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.

Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <=

Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.

Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versio

Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.

Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticat

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization v

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares en

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint a

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks

sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation

libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsin

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (li

The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications.

Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.

Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions.