2026

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its set

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on a

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and s

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP metho

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoi

Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possib

Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a writ

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Tex

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v

Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALO

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissi

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impact

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This a

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenti

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate,

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physi

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Ta

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allow

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to cre

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulne

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerabili

A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and be

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected s

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP reque

SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_d

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/b

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokeniz

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a networ

Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information o

Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a networ

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a net

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize

Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an aut

Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an aut

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin mid