2026

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vul

The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Req

The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. Thi

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inc

The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions

A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mage_ai/frontend

A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file h

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file

A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the f

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This issue affects some unkno

A vulnerability was identified in SourceCodester Inventory System 1.0. Affected is an unknown function of the file /user

A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/v

Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user t

Out of bounds read in Dawn in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to leak cross-o

Uninitialized Use in Codecs in Google Chrome on Linux, ChromeOS prior to 149.0.7827.103 allowed a remote attacker to lea

Inappropriate implementation in MediaCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker t

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to leak cro

SAP MDG (Review Match Groups Application) does not perform the necessary authorization checks for authenticated users. T

SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by

The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i

The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc

The FastPicker, an order picker and order management system (oms) for WooCommerce on steroids plugin for WordPress is vu

The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3.

The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu

Null pointer dereference vulnerability in the browser module. Impact: Successful exploitation of this vulnerability may

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not p

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP

A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial st

User interface (ui) misrepresentation of critical information in Microsoft Bing allows an unauthorized attacker to perfo

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any aut

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately

A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permi

Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permis

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GE

A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese mark

In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker coul

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the

Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handle

Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notic

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `or

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in appli

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This is