2026

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#enc

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeS

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse opti

Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., L

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Ele

Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization o

Our payment integration with Computop-based payment methods did not properly validate payment status responses. An atta

Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacke

Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.

Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.

Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.

Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access

Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.

Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.

Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Master Slider <= 3.11.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.

Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.

Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions.

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows R

Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.

Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.

Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control S

Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.

Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows

Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt

Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.

Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.

Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.

Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of D

In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logi

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted

In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating

In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-ze

In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-ze

In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock

In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write a

In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table re

In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the me

In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limi