2026

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HT

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugin

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (age

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of th

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: fro

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox th

Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

Subscriber Broken Access Control in Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms <= 6.0 versions.

Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.

Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cro

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versi

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site R

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.

Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.