2026

In the Linux kernel, the following vulnerability has been resolved: can: esd_usb: kill anchored URBs before freeing net

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: cancel pending IN work before

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain func_wake

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or support

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level

A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by thi

A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unkn

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packa

A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packag

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements d

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is re

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these propert

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all require

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delet

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OT

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. Fo

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Reque

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary us

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This a

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not mainta

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allo

A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedEle

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tool

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file s

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured a

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Store

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before o

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves tem

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admi

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe p

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputtin

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetchi

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV fil

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated us

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not pr

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict t

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment bel

PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its pub

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, all

The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is pub

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes