2026

Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.

Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.

Unauthenticated SQL Injection in Woo Essential <= 4.3.0 versions.

Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.

Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.

Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.

Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.

Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

Unauthenticated Privilege Escalation in Digits <= 9.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.

Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS,

Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform o

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 al

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the fi

A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown f

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) cond

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendere

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parse

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions,

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An atta

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth rang

The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authentic

Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Build

Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vuln

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an aut

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the fil

A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the

A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function o

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unkn

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn o

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication

A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victi