2026

Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allow

A flaw has been found in busy up to 2.5.5. The affected element is an unknown function of the file source-code/busy-mast

A flaw has been found in code-projects Patient Record Management System 1.0. This affects an unknown function of the fil

A vulnerability was detected in Open Babel up to 3.1.1. The impacted element is the function OBAtom::SetFormalCharge in

A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::tr

A weakness has been identified in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::decode_base64

A security flaw has been discovered in Beetel 777VR1 up to 01.00.09. This issue affects some unknown processing of the c

A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0. This vulnerability affects unknown code of the fil

A vulnerability was found in CoCoTeaNet CyreneAdmin up to 1.3.0. This affects an unknown part of the file /api/system/us

A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown funct

A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown function

A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /a

A flaw was found in the blst cryptographic library. This out-of-bounds stack write vulnerability, specifically in the bl

The Dealia – Request a quote plugin for WordPress is vulnerable to unauthorized modification of data due to missing capa

The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and incl

The News Element Elementor Blog Magazine plugin for WordPress is vulnerable to Missing Authorization in all versions up

The Slidorion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to

OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints b

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability wh

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability whi

Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that

OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below,

The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and

The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attr

The Whatsiplus Scheduled Notification for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery i

The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th

The Easy Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author_profile_picture_

The TalkJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, a

The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' paramet

The Tennis Court Bookings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ve

The PostmarkApp Email Integrator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settin

The Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable

The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.

The Toret Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege esc

The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin

The Shield Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in

The XO Event Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xo_event_field

The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortc

The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege esca

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escala

OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw whic

The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized modification of data

The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Cross-Site Scripting in all version

The Virusdie - One-click website security plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve

The YaMaps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `yamap` shortcode par

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' param

The Image Hotspot by DevVN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hotspot_content' c

The Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to u

The Mega Store Woocommerce theme for WordPress is vulnerable to unauthorized modification of data due to a missing capab