2026

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validat

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registratio

Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.

Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticat

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sal

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthen

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in a

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The admin

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - bui

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Eve

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine t

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate prof

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its bac

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these m

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — fu

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an at

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative creden

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configure

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by inc

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predi

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the ma

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fr

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite att

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spr

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a con

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping th

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue ap

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for examp

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto de

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes di

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deser

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and

Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Pa

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators,

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an