2026

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Di

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Informat

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypa

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direc

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versi

The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Dire

Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions.

Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.

Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions.

Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Cont

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to creat

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious us

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inc

The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization

Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attack

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends eit

A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::Int

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the requ

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release as

A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extract_media of th

A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the fil

A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of the file ad_miner/sc

A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file l

Insertion of Sensitive Information Into Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allows Retrie

Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensit

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Inject

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The ca

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The came

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service v

pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource rea

Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks.

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.

Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.

Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator

A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN)

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range(

The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and i

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC func

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend