2026

An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_lda

Authentication bypass by primary weakness vulnerability in ABB Freelance. This issue affects Freelance: through 2013, 2

Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Reque

Missing Authorization vulnerability in TemplateHouse Soledad allows Accessing Functionality Not Properly Constrained by

Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler a

Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This is

Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider an

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Lo

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacki

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An a

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's da

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-ti

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed atta

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or dis

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation di

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all version

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notificati

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to v

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenti

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-24

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to ve

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to v

A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privile

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-