2026

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before usi

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle s

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end mod

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth cre

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rat

HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Va

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It inv

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flow

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services.

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a S

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership che

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downlo

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-wr

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform

The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment vari

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submiss

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its conne

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-mana

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker t

Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had comp

Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to l

Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who conv

Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis

Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to le

Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker

Insufficient validation of untrusted input in Clipboard in Google Chrome on Android prior to 151.0.7922.72 allowed a loc

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-orig

Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had c

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convince

Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 1

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which c

In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredu

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of serv

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course compl

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name,

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the se

An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_gener

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC