2026

Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-all

The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c), used by the PIC32CM-JH SoC family, contains

The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications.

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (li

Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparis

RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header an

Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docke

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because it

libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsin

libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions

Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user

The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the P

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained va

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. Durin

The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace,

sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation

dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vu

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass

The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Paramet

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plu

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Sc

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPr

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPr

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypas

The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusions

The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, an

The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl se

The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' para

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all ve

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress pl

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on th

The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to

The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_t

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of servi

A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arb

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to t

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which a

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are

Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape