2026

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce

In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C:

Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.

Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.

Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.

Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.

Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.

Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.

Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.

Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.

Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.

Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.

Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.

Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.

Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.

Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.

Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.

Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.

Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An att

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validat

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registratio

Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.

Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticat

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sal

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthen

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in a

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The admin

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - bui

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Eve

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine t

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate prof

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its bac