2026

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. I

Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authe

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validatio

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or s

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a loca

A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnera

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as p

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrar

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service again

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system u

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the oper

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing ar

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hosti

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT p

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a tab

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to under

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as t

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a cal

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user