2026

Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under sp

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer

Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.

Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.

Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increme

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never incre

Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to ins

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregate

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ceviz Informatics

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Dayneks Software I

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib d

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r  was fixed by replacing unchecked strcpy() with a bound

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the P

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allow

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Sof

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' confi

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript v

An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Servic

An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Servic

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v

An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site na

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMed

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override hea

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes l

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop cond

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a C

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunction

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experim

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests fro

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fi

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the N

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where cr

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-cont

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule n

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when de

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs w

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attacker

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_s

gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as te

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fai

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authentic

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticat