2026

Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.

Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versi

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce Pa

Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Brow

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality

Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Cont

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint

Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team c

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and custom

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extensio

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::action

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionR

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, aut

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate()

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fai

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactiva

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied.

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name fi

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements end

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.

Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.

Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.

Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionali

Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.

Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.

Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.

Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affect

Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.

Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.