2026

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twi

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows a

A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP fronte

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creat

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, spec

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due

The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verifi

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and incl

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file conta

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorize

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requ

The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary she

Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any

ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privi

ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privi

CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default

A flaw was found in the Quay config-tool's LDAP and SMTP validation functions. An attacker with config editor access can

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter i

The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direct

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitiz

Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year al

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in version

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all

The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of th

Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all ver

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_in

The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in vers

The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via th

The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all ve

The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versi

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Sensitive Information

The Post Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including

Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s vali

An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local u

Improper handling of symbolic links in the installer of CUPS Printer Driver for macOS(*) may allow a local attacker with

Improper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8 or earlier may allow a l

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execu

Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rend

Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rende

Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potenti

Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code ins

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised

Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rende

Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code i

Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who