2026

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure D

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifyi

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of gram

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application

The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing

An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. T

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scr

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and i

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacke

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. T

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apach

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of serv

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This iss

The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 t

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apach

The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issu

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue

The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache

The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affec

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects A

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This is

Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This iss

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue af

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue a

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affe

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affect

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects A

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This i

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoi

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A re

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group m

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discov

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Au

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the n

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exe

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affe

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affe

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting H

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apa