2026

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attac

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (form

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated a

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not bl

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that all

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop actio

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in th

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, wh

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no tru

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnera

Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GH

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vu

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Contr

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Tel

Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.

Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.

Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.

Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.

Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh pa

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versio

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's

Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versio

Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.

Unauthenticated SQL Injection in Boost <= 2.0.4 versions.

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.

Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.

A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed

A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective releas

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their res