2026

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the I

The Drag and Drop File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions

The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0.

Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the

DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-Force Protection Bypass vulnerability, allowing unauthenticat

The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This

The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded me

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc

MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cros

The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file owne

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init`

Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path

Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role)

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /co

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the old

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the hap

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NT

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perfor

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perfor

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user permissions control w

Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Xibo is an open source digital signage platform with a web content management system and Windows display player software

A vulnerability in  SenseLive X3050’s web management interface allows unauthorized access to certain configuration end

A vulnerability in SenseLive X3050's web management interface allows critical system and network configuration parameter

A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established wi

A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencrypted HTTP for all adm

A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied

A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on th

A vulnerability in SenseLive X3050’s management ecosystem allows unauthenticated discovery of deployed units through the

Xibo is an open source digital signage platform with a web content management system and Windows display player software

In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/log

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version

A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be

A vulnerability in SenseLive X3050's web management interface allows state-changing operations to be triggered without p

A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be per

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allo

A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive informat