2026

The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the woolentor_quickview_button shor

PraisonAI is a multi-agent teams system. Prior to 4.5.133, there is an SQL identifier injection vulnerability in SQLiteC

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to A

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the brow

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the work

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through a

The Surbma | Booking.com Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `s

A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the

The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the `block_name` parameter of the `/wp-json/

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endp

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandb

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and be

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulnerability in

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnerability in

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mecha

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypa

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due t

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could m

Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft

Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacke

jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-539

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus a

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability whe

SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript pa

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authe

Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker

Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Structures), an attacker

Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Reference Equipment), an attacker could upd

Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Structures), an attacker c

SAP Landscape Transformation contains a vulnerability in an RFC-exposed function module that could allow a high privileg

Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated att

Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete

The Material Master application does not enforce authorization checks for authenticated users when executing reports, re

Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthent

Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catal

The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5

Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuff

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() AP

jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin

A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function

A vulnerability was identified in HummerRisk up to 1.5.0. This vulnerability affects the function ServerService.addServe