Fresh 2026 Zero-Days & Newly Disclosed CVEs

Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions....

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions....

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions....

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions....

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions....

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions....

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions....

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0....

Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions....

Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network....

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization...

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can ...

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs f...

Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers ca...

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication met...

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image...

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigge...

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server...

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser...

Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions....

Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions....

Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions....

Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions....

Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a throug...