The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross...

CVE-2026-15645

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'na

历史摘要 · 未重新核验 · GitHub Advisory

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress...

CVE-2026-16091

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is

历史摘要 · 未重新核验 · GitHub Advisory

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form...

CVE-2026-11995

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress

历史摘要 · 未重新核验 · GitHub Advisory

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in...

CVE-2026-2916

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an

历史摘要 · 未重新核验 · GitHub Advisory

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to...

CVE-2026-16087

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injec

历史摘要 · 未重新核验 · GitHub Advisory

The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site...

CVE-2026-13362

The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_

历史摘要 · 未重新核验 · GitHub Advisory

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is...

CVE-2026-7623

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cros

历史摘要 · 未重新核验 · GitHub Advisory

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection...

CVE-2026-15403

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parame

历史摘要 · 未重新核验 · GitHub Advisory

guard-livereload has a directory traversal vulnerability

CVE-2016-1000305

The vulnerability allows remote attackers to read arbitrary files on the server by exploiting improper path validation i

历史摘要 · 未重新核验 · GitHub Advisory

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

CVE-2026-54785

### Summary `consult_gemini_with_files` in **inline mode** read any file path supplied in the `files` argument without c

历史摘要 · 未重新核验 · GitHub Advisory

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

CVE-2026-54768

## Summary The `sendPasswordResetEmail` mutation in WPGraphQL is explicitly designed to prevent user enumeration. The r

历史摘要 · 未重新核验 · GitHub Advisory

core-geonetwork has an Open Redirect Bypass

CVE-2026-53573

### Summary GeoNetwork's post-login redirect handling can be bypassed to redirect users to an attacker-controlled extern

历史摘要 · 未重新核验 · GitHub Advisory

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

CVE-2026-54908

### Impact Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. ### Patches

历史摘要 · 未重新核验 · GitHub Advisory

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

CVE-2026-54909

### Impact Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute ### Patches Upgrad

历史摘要 · 未重新核验 · GitHub Advisory

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

CVE-2026-53606

## Summary sanitize-html uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `nau

历史摘要 · 未重新核验 · GitHub Advisory

Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd

CVE-2026-18321

Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd

历史摘要 · 未重新核验 · GitHub Advisory

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

CVE-2026-53551

### Summary The free5GC AUSF (Authentication Server Function) does not validate the `supiOrSuci` field in UE authentica

历史摘要 · 未重新核验 · GitHub Advisory

zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit

### Summary `NonFinalizedState::handle_reorg` is a recursive, unbounded async function that traverses parent blocks unti

历史摘要 · 未重新核验 · GitHub Advisory

ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

CVE-2026-53466

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can res

历史摘要 · 未重新核验 · GitHub Advisory

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

CVE-2026-65841

A `` element placed directly inside an `` (or MathML) container was not removed by Jodit's clean-html sanitizer. The de

历史摘要 · 未重新核验 · GitHub Advisory