2026

Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

Subscriber Path Traversal in Do Lasso <= 358 versions.

Subscriber SQL Injection in Do Lasso <= 358 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. I

Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authe

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validatio

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or s

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a loca

A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnera

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as p

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrar

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service again

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system u

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the oper

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing ar

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hosti

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT p

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a tab