2026

When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead

SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situat

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could

Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents

The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and

The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The Forms Bridge – Infinite integrations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id'

The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due

The WPBITS Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget pa

The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_na

The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress is vulnerable to Stored Cross

The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via fo

The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder_img

The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, a

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowin

Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing a

A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php o

billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart

A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in v

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink en

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in th

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Cente

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

Clatter is a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. Vers

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `Async

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by t

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in

vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.

soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mul

vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions,

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.6