2026

The Image Sizes on Demand plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Server Varia

The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, a

The Assistio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check a

The Secufor_OAuth plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.7.

The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up t

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.3

The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leadi

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, a

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a mi

The Bulk SEO Image plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1.

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administ

The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, stor

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, P

The Blue Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 2.0.1.

The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes bef

The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cincopa Shortc

The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email' sh

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-48

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-48

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-48

A memory corruption vulnerability exists in the GV-Cloud functionality of GeoVision GV-VMS V20 20.0.2.  A specially cr

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-48

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parameter of the `arf_save

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSig

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in

Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1

Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authenticat

Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) al

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email f

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacke

Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PA

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or el

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-s

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly h

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitiv

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From