2026

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed e

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the list

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) with

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools).

stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission

stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching me

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verifica

Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malici

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized us

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints ar

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verif

HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish conn

An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in t

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the ori

Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affe

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions

Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the syste

A local privilege escalation vulnerability in ESET Inspect Connector.  The vulnerability was caused by improper authenti

Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extensio

The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' para

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorizatio

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7

The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.

The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to St

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorizatio

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Pr

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Sto

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all v

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnera

The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including

The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, an

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' param

The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all v

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed

The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a t

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the

The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions,

The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a r

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or non

The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recover

The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving cus

The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a c

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actu

The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a

The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing a