2026

The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follo

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' a

The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including

The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all

The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin

The Investi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'investi-announcements-accordion'

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_v

The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `group` attribute in t

The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' and 'podca

ASDA-Soft Stack-based Buffer Overflow Vulnerability

An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails

The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to C

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to w

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escapi

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large numb

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection c

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can ope

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a ve

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate cert

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the comp

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a loc

IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the sys

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1

An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and a

The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in t

The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bu

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Ty

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized modific

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) w

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing cap

Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki

Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExper

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handle

SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger re

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk conta

Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS que

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5,

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5,

Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records

Botan is a C++ cryptography library. In 3.11.0, the function Certificate_Store::certificate_known had a misleading name;