2026

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0.

Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.

Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close o

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_m

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom

Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modu

Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio SAML Identity Provider implement

Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio

Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify wheth

Admidio is an open-source user management solution. Prior to version 5.0.9, an unauthenticated attacker can execute arbi

Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authen

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (m

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces author

Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker

Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php

Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not vali

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Sp

The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git reposi

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the co

There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execut

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and inclu

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-202

Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1.

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the l

Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload,

OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In ver

OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlie

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created f

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars e

Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated vers

Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint v