2026

The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions (a

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all ver

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_setti

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a siz

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These token

A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent com

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability ch

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable,

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist i

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_p

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting v

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the w

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs[]' Paramete

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object

In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assign

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDe

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail genera

It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated atta

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated att

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated att

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated att

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated att

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabi

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisatio

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage direc

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capa

The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page hand

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing un

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in

The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled sett