2026

The Robin Image Optimizer – Unlimited Image Optimization & WebP Converter plugin for WordPress is vulnerable to Stored C

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspensi

web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vu

Infinera DNA is vulnerable to a time-based SQL injection vulnerability due to insufficient input validation, which may r

Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality

The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content fiel

The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'load

The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-a

Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16P

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0

A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP s

A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/

A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/m

A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMig

The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPr

Wacom WTabletService 6.6.7-3 contains an unquoted service path vulnerability that allows local attackers to execute mali

Adaware Web Companion version 4.8.2078.3950 contains an unquoted service path vulnerability in the WCAssistantService th

GCafé 3.0 contains an unquoted service path vulnerability in the gbClientService that allows local attackers to potentia

Alps Pointing-device Controller 8.1202.1711.04 contains an unquoted service path vulnerability in the ApHidMonitorServic

Shrew Soft VPN Client 2.2.2 contains an unquoted service path vulnerability that allows local users to execute arbitrary

NCP Secure Entry Client 9.2 contains an unquoted service path vulnerability in multiple Windows services that allows loc

Studio 5000 Logix Designer 30.01.00 contains an unquoted service path vulnerability in the FactoryTalk Activation Servic

BartVPN 1.2.2 contains an unquoted service path vulnerability in the BartVPNService that allows local attackers to poten

ProShow Producer 9.0.3797 contains an unquoted service path vulnerability in the ScsiAccess service that allows local at

Easy-Hide-IP 5.0.0.3 contains an unquoted service path vulnerability in the EasyRedirect service that allows local attac

TexasSoft CyberPlanet 6.4.131 contains an unquoted service path vulnerability in the CCSrvProxy service that allows loca

NETGATE Data Backup 3.0.620 contains an unquoted service path vulnerability in its NGDatBckpSrv Windows service configur

Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attacker

Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut

A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the com

A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For examp

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site script

NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-ex

Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer o

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mas

SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not valid

Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists i