2026

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Ap

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: throu

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and in

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when Raise

A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SD

An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attack

Logic bypass vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect availabi

UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect ser

UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect ser

Null pointer dereference vulnerability in the browser module. Impact: Successful exploitation of this vulnerability may

Race condition vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availab

Out-of-bounds write vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect av

DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vulnerability may affec

Permission control vulnerability in service notifications. Impact: Successful exploitation of this vulnerability may aff

Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability

Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availabili

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker

The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability acros

A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sendi

The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remot

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to impro

The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and in

The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versi

The WP GDPR Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ninja_gdpr_ajax_ac

The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu

The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu

The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3.

The WP-Ultimate-Map plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1

The FastPicker, an order picker and order management system (oms) for WooCommerce on steroids plugin for WordPress is vu

The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc

The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcod

The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gbmical

The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attri

The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (a

The Extra Settings for RocketChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rocketchat'

The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in ver

The ePaperFlip Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'publicationid' attri

Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may a

Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect i

Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect s

Permission management vulnerability in the network management module. Impact: Successful exploitation of this vulnerabil

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.sprin

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provid

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Fr

A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocati

Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of S

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic