2026

A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_jo

A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts t

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the f

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted elem

A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMapping

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwardi

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deleti

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exp

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenti

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenti

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenti

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL sta

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does n

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload featur

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a r

The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against t

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthentica

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block a

In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X ser

In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-mess

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of th

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling

Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-UR

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to v

Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification cou

`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization fa

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) th

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth m

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide

The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length o

The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, read

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied da

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction han

Adobe Genuine Software Integrity Service on Windows is affected by an Incorrect Authorization vulnerability that could r

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in COR