2026

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. A

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome

Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-dep

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTM

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one o

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX ac

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the ca

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload int

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allow

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality,

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL sta

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stor

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL sta

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it i

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a f

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allo

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a ca

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-resto

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its re

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts i

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, all

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file downlo

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX a

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowi

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update his

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, al

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing user

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration han

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-a

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, th

The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (p

The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c sn

The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its cre

The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a cal

A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows

Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnera