2026

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when cre

Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote un

Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recover

Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.

Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admi

The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `e

The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting t

sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values f

Subscriber Privilege Escalation in JetFormBuilder <= 3.6.1 versions.

Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.

Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.

Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accept

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 t

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access.

Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos fro

Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_typ

Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthoriz

CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.

Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.

Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Contro

Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.

Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpa

In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing per

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to l

In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession

Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.

Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions.

Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions.

A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from impr

Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-ori

Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who ha

Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain pot

Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker

Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbi

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had co

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a

Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker w

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to obtain poten

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to leak cro

Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Objec

In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to loca

Subscriber Broken Access Control in Genemy <= 1.6.6 versions.