2026

A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listd

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimsta

Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recover

Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shi

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force S

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Trave

An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause

Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.

Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.

Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm c

Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.

Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions.

Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.

Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.

Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) cont

Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Leve

Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.

Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.

Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.

Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Pat

Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.

Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.

Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.

Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.

Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.