2026

URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUM

Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bilin Software and Infor

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bilin Software and

Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIS

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the hig

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication

A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search di

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS terminatio

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS terminatio

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in ims_pc

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-

In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart r

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR fr

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* m

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a g

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file conten

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin be

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log en

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJA

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL bef

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch p

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Po

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before upd

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted t

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handler

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML at

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetchi

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and e

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified th

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outp

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of th

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing thei

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthentica

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests th

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Bui

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `f

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file

A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurv

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file

A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versi

An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions throug

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions