2026

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conne

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Pro

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of

Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all version

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by pa

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authen

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attack

Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote atta

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remot

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability.

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed c

Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on th

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously c

When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logi

Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, res

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by comm

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all v

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in a

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Par

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no jo

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Sit

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vul

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly wi

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps ou

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named i

The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to th

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal s

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitiz

The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJA

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed t

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only f

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesyste

The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the