2026

WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereb

An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject ar

Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile

In the Linux kernel, the following vulnerability has been resolved: perf: Ensure swevent hrtimer is properly destroyed

Nord VPN 6.31.13.0 contains an unquoted service path vulnerability in its nordvpn-service that allows local attackers to

ShareMouse 5.0.43 contains an unquoted service path vulnerability that allows local users to potentially execute arbitra

Input Director 1.4.3 contains an unquoted service path vulnerability in its Windows service configuration that allows lo

ForensiT AppX Management Service 2.2.0.4 contains an unquoted service path vulnerability that allows local users to pote

Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local at

Prey 1.9.6 contains an unquoted service path vulnerability that allows local users to potentially execute code with elev

IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows loc

EPSON 1.124 contains an unquoted service path vulnerability in the SENADB service that allows local attackers to execute

The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability ch

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulne

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress

The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'f

SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situat

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could

The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a

The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, a

A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php o

A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink en

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in th

This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Cente

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by t

soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mul

vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.6

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was fo

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `wei

ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-con

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause

Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead

Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arb

Motorola Device Manager 2.5.4 contains an unquoted service path vulnerability in the MotoHelperService.exe service that

Motorola Device Manager 2.4.5 contains an unquoted service path vulnerability in the PST Service that allows local users