2026

HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to re

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a refer

The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inj

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User

Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensiti

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mo

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Cons

Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking t

A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicio

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralizatio

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection ma

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker wi

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validatio

The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access

The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the Cle

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, AC

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-c

The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoi

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configu

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible form

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attemp

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Wor

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is respo

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flow

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services.

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a gr

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoin

The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints

DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote att

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a S

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-fe

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowin

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allo

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning supp