2026

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking at

The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct O

The Phrase TMS Integration for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to

A vulnerability was identified in itsourcecode Society Management System 1.0. This affects an unknown function of the fi

A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of t

A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performi

A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This v

A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipul

A flaw has been found in SourceCodester E-Learning System 1.0. This impacts an unknown function of the file /admin/modul

A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code.

OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users,

Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulner

Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()`

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in

The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminat

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has b

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18,

Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exis

Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, al

Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actual

Cross-Site Request Forgery (CSRF) vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite all

Missing Authorization vulnerability in wproyal Bard bard allows Exploiting Incorrectly Configured Access Control Securit

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-

Cross-Site Request Forgery (CSRF) vulnerability in Angel Costa WP SEO Search wp-seo-search allows Cross Site Request For

Cross-Site Request Forgery (CSRF) vulnerability in AA-Team Wordpress Movies Bulk Importer movies importer allows Cross S

Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This

Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access

Missing Authorization vulnerability in Mikado-Themes Wanderland wanderland allows Exploiting Incorrectly Configured Acce

Cross-Site Request Forgery (CSRF) vulnerability in richardevcom Add Polylang support for Customizer add-polylang-support

Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access C

Missing Authorization vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Exploiting I

Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly

Missing Authorization vulnerability in Rasedul Haque Rumi BD Courier Order Ratio Checker bd-courier-order-ratio-checker

Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Confi

Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured A

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Inc

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorre

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-p

Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allo

Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting

Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configur

Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. An unauthenticated attac

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with rea

Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unau

Cross-Site Request Forgery (CSRF) vulnerability in Timur Kamaev Kama Thumbnail kama-thumbnail allows Cross Site Request

Missing Authorization vulnerability in MyThemeShop WP Subscribe wp-subscribe allows Exploiting Incorrectly Configured Ac

Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Contr

Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans siteloc