2026

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Informati

The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability c

The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amo

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; ove

A flaw has been found in wandb OpenUI up to 1.0. This affects the function create_share/get_share of the file backend/op

A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown funct

The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl

LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, t

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download e

WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php

The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (El

A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the

A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6

A vulnerability was identified in dloebl CGIF up to 0.5.2. This vulnerability affects the function cgif_addframe of the

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include

Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL querie

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.hea

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the We

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in t

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-

LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP l

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby S

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 thro

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Hand

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafte

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a H

Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbi

UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP

A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWiFiGuestC

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow`

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@pa

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handleb

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolve

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Respo

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, the NetworkManager role was granted backup

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing a specially crafted

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticate

Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external