2026

The AMP for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up

Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is condu

A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization lo

A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validat

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parame

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modifi

The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unau

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completio

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollmen

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and

Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.

Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access s

Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attack

Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bou

Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to e

Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary c

Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged AP

Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with syste

Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code.

The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Store

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key i

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) para

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource'

The BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce plugin for WordPress is vulnerabl

The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including

The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all vers

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorizat

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all ver

The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.

The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress

The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cr

The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c

There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper director

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown functi

A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.as

A vulnerability has been found in TOTOLINK WA1200 5.9c.2914. The impacted element is an unknown function of the file cst

A flaw has been found in PHPGurukul Staff Leave Management System 1.0. The affected element is the function ADD_STAFF/UP

A vulnerability was detected in code-projects Intern Membership Management System 1.0. Impacted is an unknown function o

The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_connection_id’

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5,

A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any user is logged in and main