2026

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Ins

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulne

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripti

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Sc

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versi

A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/ca

A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails

A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/co

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/c

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown

A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing o

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the functio

A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /ch

A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown

A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /log

A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_statu

A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the

Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differe

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to s

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stor

siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basi

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFileP

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to ex

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endp

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the

A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendanc

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the

A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unkno

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmau

A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/a

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the fi

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::in

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, r