EUVD-2026-86533

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

EUVD-2026-86529

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn fr...

OESA-2026-4113 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

OESA-2026-4114 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

PT-2026-98418

Name of the Vulnerable Software and Affected Versions Bookly WordPress plugin versions prior to 28.3 Description An issue exists where the software fails to properly verify a customer's identity before updating stored details. This allows unauthenticated attackers who possess a customer's primary...

CVE-2026-78397: Server-Side Request Forgery (SSRF)

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn fr...

CVE-2026-96766: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

CVE-2026-78394: Improper Limitation of a Pathname to a Restricted Directory

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...

PT-2026-98908

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.21 RabbitMQ versions 4.1.x prior to 4.1.14 RabbitMQ versions 4.2.x prior to 4.2.7 RabbitMQ versions 4.3.x prior to 4.3.1 Description An atom exhaustion issue exists when the Management plugin is enabled. A...

PT-2026-98360

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn fr...

PT-2026-98383

Name of the Vulnerable Software and Affected Versions SSL Zen plugin for WordPress versions prior to 4.7.43 Description Reflected Cross-Site Scripting occurs when unauthenticated attackers trick users into clicking specially crafted links to inject arbitrary web scripts. The issue exists because...

PT-2026-98419

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress plugin versions 1.9 through 3.7.49 Description Insufficient verification occurs when a member requests enrollment in a course. The plugin fails to confirm if the requested course is included in the user's membership...

CVE-2026-67227: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2 and the PUT/DELETE handlers call rabbitdatacoercion:toatom/1 on the :name URL path segment. toatom/1 uses binarytoatom/2 unsafe...

CVE-2026-67222: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a larg...

CVE-2026-17577: Improper Neutralization of Input During Web Page Generation

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

PT-2026-98903

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description A protected tag bypass exists when the rabbitmqmanagement plugin is...

CVE-2026-88848: Incorrect Authorization

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...

PT-2026-98904

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description An issue exists where the mechanisms/1 function applies list to atom/1 ...

PT-2026-98906

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description When the stream plugin is enabled, the stream protocol stores the...

PT-2026-98992

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...