2026

MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with t

MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree

MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each pass

MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/tradin

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching m

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when

In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/h

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Ad

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Esca

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in

Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Securit

The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in a

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The gene

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge MB-

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attri

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode

DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.

DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.

DVP80ES3 with  Improper Resource Shutdown or Release vulnerability.

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in a

The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Co

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all ve

The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offl

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain con

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowe

The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access

DVP80ES300T with Improper Validation of Array Index Vulnerability

AS228T with Authentication Bypass Vulnerability

The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authent

The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription canc

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date

The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress

The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an

The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status

The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions,

The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after

A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerabili

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting

UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The func

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repea

UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failu

UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In v