2026

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate cer

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or pro

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape use

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox a

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames cor

CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula chara

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HT

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugin

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (age

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of th

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: fro

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme <= 2.17.22 versions.

Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

Subscriber Broken Access Control in Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms <= 6.0 versions.

Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.

Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cro

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versi

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions.

Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.

Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.