2026

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, g

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' paramete

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed wh

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its pa

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing

A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An un

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the

The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin fo

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to S

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is v

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (b

A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the f

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /ve

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv A

The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is v

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vul

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cr

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortc

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all vers

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order'

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode A

Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match uni

Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing i

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS

Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controll

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a fi

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nest

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by

Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-in

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expr

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-f

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI sch

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unaut