2026

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured im

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowi

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises use

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capab

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly saniti

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alt

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries da

NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inje

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vuln

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all vers

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all version

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attrib

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all

A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operatio

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowin

A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows

A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an a

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an aut

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker

A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows

A server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenti

A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authen

A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allo

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-priv

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration

A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privile

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker t

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker

A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator wi

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client s

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on th

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas

Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaus

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated a

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker

A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to creat

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker t