2026

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Inform

Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allo

Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentica

The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,

The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Obje

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to unauthorized access

The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `boo

A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in

Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFi

The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lin

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors r

When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disab

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functional

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attac

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of

A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation

The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Short

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is

The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all v

The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attr

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Lo

The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulner

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is v

The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerab

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate fro

Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-

Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege

Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-s

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new

The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfi

The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performe

The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performe

The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belong

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session co

The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-proces

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-not

The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the ope

A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validat

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allo

A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code

A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the f