2026

express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to version

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke e

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NV

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there

Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulne

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in a

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauth

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the /a

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowis

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.

The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0

The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up

The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized message delet

The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date_from' and 'date

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_sa

The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1

The Hammas Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'apix' parameter in the 'h

The MDJM Event Management plugin for WordPress is vulnerable to unauthorized data modification due to a missing capabili

The ZIP Code Based Content Protection plugin for WordPress is vulnerable to SQL Injection in all versions up to, and inc

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a stored cross-site scripting vulnerabil

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnera

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a missing authentication vulnerability i

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Referenc

The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized mod

The WP Frontend Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl

Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate work

Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/seri

Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDept

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, a

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, a

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta t

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo cou

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the

When verifying a certificate chain which contains a certificate containing multiple email address constraints which shar

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization fl

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication c

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not r

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentica

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.