2026

Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.

Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.

Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Pat

Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.

Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.

Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.

Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.

Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o

Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin

Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.

Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.

Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

Subscriber SQL Injection in Cornerstone < 7.8.8 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary c

Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist

Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.

Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.

Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthent

Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.

Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Version

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, f

Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.

Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.

Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.