2026

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execu

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Por

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Ru

Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allow

Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.

Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC

Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.

Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 vers

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, no

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or p

Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remo

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Info

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageSe

A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPre

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authe

OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authe

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfrestt

Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint h

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enque

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager whe

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Securit

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted

A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function sc

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/pp

Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allow

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Indu

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospec

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of