2026

Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o

Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: f

Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue aff

Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects

Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: fr

Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions.

Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.

Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admi

The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `e

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin

The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting t

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan);

sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values f

Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.

Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.

Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.

Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

Subscriber Privilege Escalation in JetFormBuilder <= 3.6.1 versions.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.

Subscriber SQL Injection in Cornerstone < 7.8.8 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary c

Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.

Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or

Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

Unauthenticated SQL Injection in JetEngine <= 3.8.9.1 versions.

Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.