2026

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenti

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenti

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL sta

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does n

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload featur

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a r

The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against t

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthentica

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block a

In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X ser

In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-mess

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of th

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling

Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-UR

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to v

Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification cou

`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization fa

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) th

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth m

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide

The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length o

The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, read

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied da

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction han

Adobe Genuine Software Integrity Service on Windows is affected by an Incorrect Authorization vulnerability that could r

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in COR

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Co

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Andr

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid in

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) th

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functi

A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the f