2026

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing u

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST p

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders,

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an or

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used t

The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an att

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does n

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allow

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript con

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 d

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid

The root password hash of the device can be obtained through unencrypted information in the firmware.

A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in th

A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys

A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C

A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code o

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via imp

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slid

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This

A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Fil

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memor

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kern

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause G

A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functional

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a n

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a netwo

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elev

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevat

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges ove

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privile

Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows a

Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A ma

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization chec

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference