2026

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due

The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on t

IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using p

Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user in

Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user in

dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting th

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to

PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability,

URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. Th

A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClient

The Viet contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up

The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' p

The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, al

Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perfor

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker t

Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to pe

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for Wo

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, a

The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a miss

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in

The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for W

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage me

A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crm

A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of th

Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An au

A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of d

A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cac

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3,

Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry P

Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()`

CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prio

File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview,

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypas

Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulner

A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripti

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version

A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql

A vulnerability was found in birkir prime up to 0.4.0.beta.0. The impacted element is an unknown function of the file /g

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.

HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ce

Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request

A vulnerability has been found in birkir prime up to 0.4.0.beta.0. The affected element is an unknown function of the fi

A flaw has been found in birkir prime up to 0.4.0.beta.0. Impacted is an unknown function of the file /graphql of the co

Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to