2026

A vulnerability has been identified in NX (All versions < V2512), NX (Managed Mode) (All versions < V2512). The affected

The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in

A vulnerability has been identified in Polarion V2404 (All versions < V2404.5), Polarion V2410 (All versions < V2410.2).

The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. Thi

A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not

Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade In

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Obj

AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers

AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote atta

Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to u

Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to

Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbi

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject ar

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the

The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI Form Builder module in all

A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script w

An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are n

AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code executio

A vulnerability was found in D-Link DCS-931L up to 1.13.0. This affects an unknown part of the file /goform/setSysAdmin.

A vulnerability has been found in aardappel lobster up to 2025.4. Affected by this issue is the function lobster::Parser

SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when cli

Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages),

Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker w

SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripti

SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to

The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters

SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks f

SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these op

Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacke

In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gainin

An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular us

SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, res

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtai

Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administr

Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator wit

A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a car

Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could in

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform backgrou

The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert m

The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficientl

SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted en

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function modul

In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authen

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause t

Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker c

A flaw has been found in aardappel lobster up to 2025.4. Affected by this vulnerability is the function WaveFunctionColl