2026

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the o

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline cont

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-co

The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowin

The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-m

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment

The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one o

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that w

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its

The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation be

## Summary

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its s

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before refle

The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through cer

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields befor

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improp

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and inc

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including,

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a vi

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) a

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom c

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom c

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimit

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows

ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYP

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing a

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, P

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with

ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) b

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cUR

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to vali

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is e

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that adve

better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endp

better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redi

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator b

@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.

@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization b

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling