2026

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of th

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads

Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API

A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the fi

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the fi

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application t

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over

Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriag

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who s

Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban all

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter

A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of t

A vulnerability was identified in Beetel 450TC3 01.00.00_01. This vulnerability affects unknown code of the component Us

A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can

A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the compone

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unkn

A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages

A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown functi

A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simp

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape v

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting th

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of custome

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files ext

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custo

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them

A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLeng

A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tc

A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_req

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5.

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attack

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impe

### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value un

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read acc

Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large arr

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read acc

### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a t

A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknow

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of t

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processin

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versio

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and i

Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata f

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode.