2026

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Privilege Management vulnerability. A high pri

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery (SSRF) vulnerability. An una

An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the a

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can brea

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAli

Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in serv

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain G

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated requ

Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.

Unauthenticated Local File Inclusion in Resido <= 1.5 versions.

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.

Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.

Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.

Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program h

The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protec

As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing

After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqu

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthentica

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored C

The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for

The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer fo

Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepa

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an obje

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires th

The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pas

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewr

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing t

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it i

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecti

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using i

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it i

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before o

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachabl

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string para

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verifica

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allow