2026

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbe

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A use

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after s

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto fi

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress_lznt d

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on co

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The dr

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC

In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before ac

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range pa

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr ent

In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its lo

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email c

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to buil

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question ba

SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of th

SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of th

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns t

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of th

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Script

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to,

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advan

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured im

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowi

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises use

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capab

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly saniti

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alt

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries da

NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inje

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vuln

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all vers

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all version

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attrib

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all

A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operatio

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowin