2026

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Boun

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on a

Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessiv

The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_container' attr

The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'l

The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3

The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.

The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [p

The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode a

The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8.

The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of t

The WP Circliful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of t

The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and includi

The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to,

The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including

The Visa Acceptance Solutions plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and inc

The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3

HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem str

A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validat

An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restric

Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The _make_salt and

The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cr

Deadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone whose authoritative nameserver addr

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS

It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management applic

Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arb

Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic o

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disc

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function tha

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-r

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc

immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open re

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versio

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authoriza

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in in

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior con

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulne

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypasse

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site S

The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event descriptio

The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_i

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauth

The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xco

The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in th

An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 th