2026

The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt han

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated tr

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values bef

Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints

A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: <= 1.34).

A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPres

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Admin

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this v

Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the v

A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/jav

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince co

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code o

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_upload

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/fu

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jqu

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/up

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence r

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap cor

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitra

Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code insi

Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perfo

Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the en

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-q

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the e

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote att

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39,

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-p

NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide

NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an a

An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code v

FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. T

Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenti

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private k

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.