2026

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows g

A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The int

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` a

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certifi

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encod

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Danc

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning p

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the bu

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing a

The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it veri

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowi

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a wo

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation i

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation i

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attri

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value be

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a re

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing u

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outpu

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellatio

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fe

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` v

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle d

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IO

In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update fa

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: call missing mem_cgroup_ite

In the Linux kernel, the following vulnerability has been resolved: efi: Allocate runtime workqueue before ACPI init S

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: fix memory block reference lea

In the Linux kernel, the following vulnerability has been resolved: mm: fix __vm_normal_page() to handle missing suppor

In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix memory block reference leak

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix potential memory leaks in ipc_

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_ad

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded sk_receive_

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map->ops->elt_free() if elt_al

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virtualization on Hygon

In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: fix pm_runtime leak on mutex_lock failu

In the Linux kernel, the following vulnerability has been resolved: spi: qup: fix error pointer deref after DMA setup f

In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setu

In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup