CVE-2026-15797: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-100024

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101725

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100592

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100972

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-93873: Cross-Site Request Forgery (CSRF)

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

PT-2026-95211

Name of the Vulnerable Software and Affected Versions Nextcloud affected versions not specified Description An improper authorization issue exists in the DAV plugin where the system resolves files from the absolute request URI without verifying if the path segment matches the authenticated sessio...

PT-2026-95263

Name of the Vulnerable Software and Affected Versions Clean Login WordPress plugin versions prior to 1.19 Description The plugin fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass anti-automation controls on the registratio...

CVE-2026-81340: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-18441: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

PT-2026-95254

Name of the Vulnerable Software and Affected Versions Bookit — Booking & Appointment Calendar WordPress plugin versions prior to 2.6.0.5 Description An authorization check is missing in an appointment-retrieval action. This allows users with a low-privilege role specific to the plugin to access...

PT-2026-95700

Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 1.0.1 Description The software contains an open redirect issue within the cot url check function. This occurs because the function uses a regular expression to validate redirect destinations that lacks an end-of-strin...

PT-2026-95704

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0 Description The contact plugin submission handler fails to validate anti-CSRF tokens. This allows attackers to use attacker-controlled pages to auto-submit contact forms, sending forged messages to the administrator inbox...

CVE-2026-89008: Exposure of Sensitive Information to an Unauthorized Actor

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

PT-2026-100547

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101075

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101965

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101299

Security vulnerability affects the nvidia-device-plugin package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100417

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-95267

Name of the Vulnerable Software and Affected Versions InfiniteWP Client plugin for WordPress versions prior to 1.14.0 Description An issue exists in the get comments action where insufficient escaping of array-key names in the JSON request body allows for SQL Injection. The IWP MMB Comment::get...