2026

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blin

Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If the

Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS ve

Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated at

Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigg

Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to acce

Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged act

Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to tri

Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to exec

Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary

Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensi

Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique id

The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a mi

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vul

The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versi

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vul

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all v

The Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Stored Cross-S

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the creat

The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct

After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $r

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting clie

When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the loc

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAny

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write priv

Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitr

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege esca

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege esca

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Ma

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing conf

Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and poten

The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.

The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnera

ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attack

ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and veri

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate

GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthentica

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directiv

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject a

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a

ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and

ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and veri