2026

A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Atta

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the

The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include

Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to

HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to send an ema

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time comple

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free v

Raytha CMS is vulnerable to SQL Injection within the OData filter parsing pipeline.  The vulnerability allows a remote,

PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support fr

Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administr

Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API.

Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Succ

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' produci

The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitr

The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting a

Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cr

DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, which may lead to arb

RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability. If a user loads

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive,

Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access contro

Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-

The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys b

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, a

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's ca

The Plugin for Google Analytics by IO technologies plugin for WordPress is vulnerable to Cross-Site Request Forgery in v

The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting

The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification and loss of data in

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via a

The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race C

The Team Members – Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scriptin

rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads s

Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, ava

The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) use

A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows

A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows at

mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of sm

Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not exp

A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cause a D

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue()

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ig

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisa

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connect

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first cond

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.