2026

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation cri

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied dur

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order informa

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or s

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values be

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to th

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds th

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the req

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated end

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation che

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, gr

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when impor

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, al

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and th

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling be

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its setti

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path b

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthentic

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vC

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2db

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2db

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylo

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptograph

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() i

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role hold

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the G

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that

An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL state

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session ope

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during

An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough r