2026

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in al

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in a

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Ser

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 th

An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same n

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handl

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server.

Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: fr

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allow

VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to e

VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to

A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course compl

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers f

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 bucke

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, incl

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled s

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name,

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the se

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject thro

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject thro

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject thro

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-

An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCOR

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bin

The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowin

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor log

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox ca

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauth

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API e

The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability chec

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all ver

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field'

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the p

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl