PT-2026-101299

Security vulnerability affects the nvidia-device-plugin package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100417

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-95267

Name of the Vulnerable Software and Affected Versions InfiniteWP Client plugin for WordPress versions prior to 1.14.0 Description An issue exists in the get comments action where insufficient escaping of array-key names in the JSON request body allows for SQL Injection. The IWP MMB Comment::get...

PT-2026-95261

Name of the Vulnerable Software and Affected Versions All Bootstrap Blocks WordPress plugin versions prior to 1.3.32 Description The plugin fails to validate a block attribute used to construct a filesystem path during rendering. This allows users with contributor-level access or higher to perfor...

PT-2026-95240

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.8.15 Description Unauthenticated visitors can attach unrestricted file types to the live chat feature. Because the plugin fails to sanitize the contents of these...

PT-2026-95241

Name of the Vulnerable Software and Affected Versions UpsellWP versions prior to 2.2.10 Description The UpsellWP WordPress plugin fails to verify if products added to the cart via a Frequently Bought Together campaign are actually part of that specific campaign. This allows unauthenticated users ...

PT-2026-95251

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if the requesting user owns a course before returning its enrolled-student data. This allows...

PT-2026-95258

Name of the Vulnerable Software and Affected Versions Breeze Cache WordPress plugin versions prior to 2.5.15 Description The plugin fails to include specific tracking-related query parameters in its page-cache key while continuing to cache pages requested with those parameters. This allows an...

PT-2026-95293

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.3.1 Description An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs because the additional params...

PT-2026-95283

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.4 Description An Insecure Direct Object Reference IDOR exists in the LatePointAbilityDeleteBooking::execute function due to missing validation on a...

PT-2026-95232

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup WordPress plugin versions prior to 7.111 Description Several AJAX actions do not perform proper capability checks and are instead protected by an installation-wide secret. This secret is disclosed to any user...

PT-2026-95231

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient per-object ownership or capability checks occur when updating orders via the REST API. This allows users with the Instructor role to modify any order on the sit...

CVE-2026-88844: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-87966: Authorization Bypass Through User-Controlled Key

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

PT-2026-101925

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100841

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-95597

Name of the Vulnerable Software and Affected Versions Weaver E-cology affected versions not specified Description An unauthenticated SQL injection allows remote attackers to execute arbitrary SQL queries. This occurs when malicious input is submitted through the userIdentifiers GET parameter in t...

PT-2026-95701

Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 1.0.1 Description The ratings plugin AJAX handler fails to validate anti-CSRF tokens, which are unique tokens used to prevent Cross-Site Request Forgery CSRF—an attack that forces an authenticated user to execute...

PT-2026-95676

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An OS command injection flaw exists in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-3688)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...