2026

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.

Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Pre

Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLH

Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read ac

Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest

Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernet

Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.

Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrect

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.

Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.

Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat w

Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.Thi

Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclu

Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAt

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command a

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0,

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerabi

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate t

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12,

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPending

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plug

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`),