2026

wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expo

Server-Side Request Forgery (SSRF) vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer allows Server Side Req

Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior contain an excessive file permissions vulnerability

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0

A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged at

A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send overs

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.9

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, t

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versi

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versi

Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a moderato

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below,

The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in ver

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DELETE /api/v1/projects/:pr

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14

A path handling issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.4. An app with root

Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.1

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versio

Mattermost Plugins versions <=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows a

Ruckus Access Point products contain an arbitrary file read vulnerability in the command-line interface that allows auth

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.1

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users log

A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote at

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inpr

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus a

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to res

Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content nelio-content allows Server Side Reques

Missing Authorization vulnerability in Ronik@UnlimitedWP WPSchoolPress wpschoolpress allows Exploiting Incorrectly Confi

Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete

A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, F

October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4

October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal a

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data

Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingSer

The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate',

The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Dire

Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privile

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information dis

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are