2026

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an obje

When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup f

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires th

The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pas

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewr

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing t

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing a

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually bee

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to t

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it i

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecti

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input o

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allo

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, all

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allo

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, all

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX ac

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising t

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache fil

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using i

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on tw

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it i

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before o

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachabl

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string para

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its mult

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verifica

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the RE

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before sa

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated requ

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allow

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allow

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before ass

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modi

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowi

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file mana

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has adm

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's curr

When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range

During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress i

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of