2026

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default alg

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predict

The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbit

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to be

A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of

A flaw has been found in IObit Malware Fighter up to 13.2.0. Affected by this vulnerability is an unknown functionality

A vulnerability was found in HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215. This affects an unknown par

A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of th

A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10. The impacted element is an unknown functio

A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file

The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax f

The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marke

A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote

WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform un

Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using d

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts

Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trig

Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.

Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.

Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up t

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152

Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 14

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The sup

Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control S

The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `e

Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint

markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer:

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security desc

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, re

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitiv

The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4

The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac

Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oa

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due