2026

Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipu

IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local a

Kuicms Php EE 2.0 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inje

Atomic Alarm Clock 6.3 contains a stack overflow vulnerability that allows local attackers to execute arbitrary code by

Huawei HG630 V2 router contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain a

Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbi

Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated atta

Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts

WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenti

WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers

Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force

Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty enco

Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all plat

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via th

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in al

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote den

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denia

An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allow

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysU

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysD

The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and includi

ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF token

ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a

Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrato

ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If process

ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected produc

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing c

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and in

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr par

ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files

Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and the

When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify t

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password use

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done u

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following cond

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the s

The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in al

The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2

The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalc

csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the tem

The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modifi

The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.a

Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a l

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git pus

The Snow Monkey Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-slick' attribute

A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-ra

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text