2026

Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-im

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerab

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerab

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCallback mod

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize modu

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. Th

Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data

Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Dig

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc.

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Hu

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human

URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUM

Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bilin Software and Infor

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bilin Software and

Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIS

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the hig

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication

A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search di

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS terminatio

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS terminatio

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in ims_pc

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-

In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart r

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR fr

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* m

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a g

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file conten

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin be

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log en

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJA

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL bef

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch p

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Po

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before upd

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted t

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handler

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML at

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetchi

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and e

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified th

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outp

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of th

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing thei

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthentica