2026

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJ

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check whe

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a val

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's b

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's a

The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Esca

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privi

A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the functio

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not N

FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allow

APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthe

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/control

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/c

A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.c

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outs

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset

PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/614

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA in

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on man

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools

A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tool

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rende

Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had com

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social

UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address ba

Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromi

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging socia

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leve

Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbit

Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromis

Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineeri

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rend

Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak s

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code ins

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise