2026

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.

Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login logging mechanism. When an unaut

Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, ru

Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a mali

Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sens

Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the ex

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table cre

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as th

Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which cau

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover us

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lsee

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitra

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite loca

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server

Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to un

Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to

WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can sen

Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and

Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Pu

Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ en

Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via

The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints wher

Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc. Yaay Social Med

Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Config

Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unb

An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "str

Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. I

Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to

Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Comme

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce So

The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titl

The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 vi

The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all ver

The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, an

The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.9 via the

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.

The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7

The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privile

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion i