2026

A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. W

Server-Side request forgery (SSRF) vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Requ

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates fro

A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisonin

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not r

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not p

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing u

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST p

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders,

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an or

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used t

The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an att

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does n

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allow

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript con

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 d

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid

The root password hash of the device can be obtained through unencrypted information in the firmware.

A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in th

A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys

A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C

A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code o

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via imp

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slid

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This

A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Fil

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memor

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kern

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause G

A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functional

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a n

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a netwo

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elev

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevat

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.