2026

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-r

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS

The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.

The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote a

A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated,

A flaw was found in GIMP. This vulnerability, a buffer overflow in the `file-seattle-filmworks` plugin, can be exploited

ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included i

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.

The CodeColorer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in 'cc' comm

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘crsea

The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.

The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server version

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template en

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulner

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all

SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability. When

The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all

Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search paramet

HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the vic

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function i

Parsing a malicious font file can cause excessive memory allocation.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported vers

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Support

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human work

The a+HCM developed by aEnrich has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to

DeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which all

Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory ini

The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

The WP Responsive Popup + Optin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to a

A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially craf

ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML

A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before versi

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an incons

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-

Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search quer

Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a

pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered e

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where

A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the do

A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php v

A reflected cross-site scripting (XSS) vulnerability exists in WebFileSys version before 2.32.0 and fixed in v.2.32.0. U

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected version

OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary en