2026

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-tab

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /ca

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown fun

Wekan is open source kanban built with Meteor. Prior to 9.64, Wekan has a cross-board authorization bypass in the direct

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scope_locati

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authoriz

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorize

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery.

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to,

The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i

The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. Th

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference

The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cac

The SurfLink - Ultimate Link Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missi

The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized acc

The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and incl

The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in al

The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includi

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypas

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows o

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functiona

A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the f

A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file

A security vulnerability has been detected in igweze wizgrade up to b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. This vulne

The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creati

The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email fo

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared

Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control

Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration change

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels per

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its

The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unkno

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unkno

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allo

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the fi

SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user c

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user

A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function h

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existenc

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Di

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.

Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all v

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all v

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a craft