2026

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a p

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurri

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value af

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before us

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it m

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument us

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_path

ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-control

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_previ

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpo

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin r

Full details and mitigation steps are currently restricted and will be published at a later date.

Full details and mitigation steps are currently restricted and will be published at a later date.

Full details and mitigation steps are currently restricted and will be published at a later date.

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mc

An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Googl

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A mis

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to t

A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attack

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to r

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane dat

An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a s

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Syli

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} acc

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authentic

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticat

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX conne

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform stat

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated a

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool J

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two end

SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyf

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creatin

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker c

IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.

IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.1

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 a

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filt

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to tr