2026

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file contain

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config fil

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3,

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3,

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environ

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decodi

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 reg

Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memor

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, r

Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unpr

Sales Representative SQL Injection in Groundhogg <= 4.5 versions.

Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.

Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.

Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.

Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.

newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.

Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.

Contributor SQL Injection in WP Post Author <= 3.9.1 versions.

Contributor SQL Injection in Gallery <= 4.7.8 versions.

Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.

Administrator SQL Injection in Popup box <= 6.0.1 versions.

Administrator SQL Injection in WP All Import <= 4.0.1 versions.

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows

Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.

Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions.

Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.

Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.

Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass

Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

Subscriber SQL Injection in Tourfic <= 2.22.5 versions.

Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.

Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.

Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.