2026

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG p

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on un

In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible

In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XM

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing au

Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in th

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, a

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField()

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExpor

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://pl

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A

Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5

Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.

Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.

Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.

Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.

Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.

Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.

Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualiz

Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 ve

Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.

Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.

Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allow

Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.

Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 ver

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.

Administrator PHP Object Injection in Complianz <= 7.5.0 versions.