Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.
Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.
Subscriber Broken Access Control in Motors < 1.4.107 versions.
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.
Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.
Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
Subscriber Broken Access Control in Bookify <= 1.1.1 versions.
Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.
Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.
markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and c...
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could ...
A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening...
Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers to obtain the TLS private key material via a crafted GET request.
A cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical characte...
An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a crafted request or payload.