2026

Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.

Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.

Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.

Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.

Unauthenticated Privilege Escalation in Easy Elements for Elementor &#8211; Addons &amp; Website Templates <= 1.4.9 vers

Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.

Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.

Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.

Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.

Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issu

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issu

An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.1

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12

An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a res

Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauth

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnera

Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missin

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoin

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows

The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.pa

Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1

Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This i

RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp lengt

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by

Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows

Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trust

In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in m

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COO

In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offlo

In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup(

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list