Fresh 2026 Zero-Days & Newly Disclosed CVEs

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions....

Unauthenticated Broken Access Control in picu <= 3.10.1 versions....

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions....

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions....

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions....

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions....

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions....

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects ...

Subscriber Broken Access Control in WPO365 <= 44.1 versions....

Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions....

A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The att...

Memory corruption while processing service requests....

Memory Corruption when executing system service routines due to improper handling of user input buffers....

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations....

Transient DOS when processing a continuous receive command with a zero-sized global configuration override....

Memory corruption when processing draw objects of incorrect type during graphics command list execution....

Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization....

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed....

Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms....

Memory corruption when non-secure loader rewrites page tables before secure memory initialization....

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionalit...

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST...

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email'...

Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions....