2026

The SMTP2GO for WordPress – Email Made Easy plugin for WordPress is vulnerable to unauthorized access in all versions up

The Geo Mashup plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.13.19.

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scr

The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary F

The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including,

A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive

A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vuln

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server

A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malici

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjec

The LiveSmart Video Chat Live Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all vers

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i

The Meta Field Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i

A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client man

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially cra

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incor

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When cer

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by acces

The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Thro

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i

The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and i

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant admin

This vulnerability in Veeam Service Provider Console allows for remote code execution.

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-base

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7

The Login No Captcha reCAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `$_SERVER['PHP_

A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulne

Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot:

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Micro

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Micro

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Micro

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Micro

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Micro

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releas

Tanium addressed an unauthorized code execution vulnerability in Connect.

uniget is a universal installer and updater for (container) tools. Prior to 0.27.1, a command injection vulnerability ex

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to bef

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication

Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook serv

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM modu

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remot

Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.