2026

A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Rea

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers w

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated thro

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allo

Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded i

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to injec

n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site sc

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verifi

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allo

Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that all

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthentica

Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recom

Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' fo

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauth

Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix FSCTL permission bypass by adding a perm

Argument Injection in TortoiseGitBlame via Malicious Git History Filenames Leads to Arbitrary File Write in TortoiseGit

In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid NULL deref of conn->lnk in smc_msg_e

In the Linux kernel, the following vulnerability has been resolved: tun: zero the whole vnet header in tun_put_user()

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix NULL deref in rds_ib_send_cqe_handler(

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage

In the Linux kernel, the following vulnerability has been resolved: tap: fix stack info leak in tap_ioctl() SIOCGIFHWAD

In the Linux kernel, the following vulnerability has been resolved: crypto: jitterentropy - replace long-held spinlock

In the Linux kernel, the following vulnerability has been resolved: ipc/shm: serialize orphan cleanup with shm_nattch u

In the Linux kernel, the following vulnerability has been resolved: af_unix: Reject SIOCATMARK on non-stream sockets S

In the Linux kernel, the following vulnerability has been resolved: batman-adv: clear current gateway during teardown

In the Linux kernel, the following vulnerability has been resolved: vrf: Fix a potential NPD when removing a port from

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: stop hash:* range iteration at en

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: disallow unicast fragment in frag

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: stop OGMv2 on disabled interface Wh

The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1

The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a

The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted image src attributes i

The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, an

The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin

The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure i

The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing

The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up t

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorizati

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modifi

The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and

The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribut

The Avalon23 Products Filter for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '

The RentMy Real-Time Rental Management Plugin plugin for WordPress is vulnerable to authorization bypass in all versions

The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu

The EntreDroppers plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all ver

The Image Sizes on Demand plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Server Varia

The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, a

The Assistio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check a

The Secufor_OAuth plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.7.