2026

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content m

The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due

The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin

The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Dire

The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate',

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This

The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of `extract($arg

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used t

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they w

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in al

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based B

The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.1

SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in b

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/n

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt pa

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves upl

pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity de

Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UA

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, Mermaid diagrams are rendere

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttr

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttr

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server version

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER deco

Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie d

sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remot

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJA

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the han

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the han

free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the han

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transpor

mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRe

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame

Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingSer

Cryptomator is an open-source client-side encryption application for cloud storage. Version 1.19.1 contains a logic flaw

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocit

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC paramete

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands t

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection

A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with admi

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerab

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A hi

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hy

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.