2026

On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintain

Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successfu

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i

A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can

A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` compo

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracke

A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially craf

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an

Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.

Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.

Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.

Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.

Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.

Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.

Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.

MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local inst

Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.

Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.

Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.

Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.

Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.

Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions.

Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.

Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.

Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.

Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.

Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.

Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.

Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.

Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.

Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.

Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions.

Subscriber Broken Access Control in Amelia <= 2.2 versions.

Subscriber Broken Access Control in myCred <= 3.0.3 versions.

Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.

Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.

Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.

Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.

Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.

Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.

Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.