2026

Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The

The Gravity Bookings Premium plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2

A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-S

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via s

The Fluent Forms plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 6.2.1. This i

Vulnerability in the Oracle OCI CLI product of Oracle Open Source Projects. The supported versions that is affected is 3

Vulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versions that is affected

The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when H

A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead

An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by

The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation du

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a mis

An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 a

An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor befor

In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no addition

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additio

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additio

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additio

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additio

In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service w

In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign auth

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation

OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a maliciou

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the fu

In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir f

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1,

lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_l

Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access c

CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementati

Incus is an open source container and virtual machine manager. In versions prior to 7.0.0, the image import flow issues

A vulnerability has been found in D-Link DI-8100 16.07.26A1. This vulnerability affects the function sprintf of the file

A flaw has been found in D-Link DI-8100 16.07.26A1. This affects an unknown part of the file /url_member.asp of the comp

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap

Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 throu

Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 throu

Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exist

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists fo

FluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin.

PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerabili

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniSe

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipe

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several P