2026

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.

Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 version

Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.

Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number o

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and

A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Ex

A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affect

Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users a

Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read mileston

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it in

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-log

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration Wor

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and incl

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggrega

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file commo

A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.exter

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file s

A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserN

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/mod

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of t

A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functio

In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thre

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_ex

In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount

In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spin

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_vev

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation ent