2026

Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string pa

Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software I

Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.

Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.

Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.

Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.

Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Secur

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistor

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path arg

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's medi

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's medi

XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /ap

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a ver

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prio

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallo

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC tok

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restor

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notificat

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php h

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OI

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages tha

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.

TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter v

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file

A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto

A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Label

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the d

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att