2026

Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mo

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch comm

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import funct

A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multu

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticat

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before

Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.

Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions.

Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.

Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.

Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.

Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.

Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.

Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.

Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.

Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versio

Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.

Unauthenticated Sensitive Data Exposure in WCBoost &#8211; Products Compare <= 1.1.0 versions.

Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.

Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.

Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.

Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.

Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.

Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <=

Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.

Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.

Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.

Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against int

When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation

A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary