2026

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 doe

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 doe

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of it

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes

A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service i

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_conte

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the

An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local  administrator to caus

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown functio

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-sc

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor N

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can caus

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the c

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frame

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a

Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type,

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown functio

A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter

The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fet

Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.

Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().

The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerab

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable t

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable t

HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of se

HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow

HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allo

A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler

SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evalu

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an exter

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new F

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints i

The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanis

In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitra

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacemen

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as r