PT-2026-93826

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update category.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit...

PT-2026-93391

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the NTFS3 file system. The functions ntfs reparse init and ntfs objid init parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles. Thes...

PT-2026-93862

Name of the Vulnerable Software and Affected Versions ContiNew Admin versions prior to 4.1.1 Description An authorization bypass exists in the personal message delete endpoint. Authenticated users can delete messages and announcements belonging to other users by providing arbitrary message...

CVE-2026-92603: Authorization Bypass Through User-Controlled Key

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message r...

CVE-2026-92385: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/updatecategory.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit h...

CVE-2026-92462: Missing Authorization

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

CVE-2026-92461: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

CVE-2026-92460: Missing Authorization

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-27546: Authentication Bypass Using an Alternate Path or Channel

An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...

PT-2026-93267

Name of the Vulnerable Software and Affected Versions JetFormBuilder versions prior to 3.6.3 Description An issue exists where the plugin fails to validate if a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post content as form schema and executing an Advanced...

PT-2026-93333

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password...

PT-2026-93355

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93339

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An unauthenticated remote attacker can exploit an authentication bypass in the account log function to gain administrative access, regardless of whether accounts...

PT-2026-93354

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93353

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93321

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the si...

CVE-2026-85131: Cross-Site Request Forgery (CSRF)

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...

PT-2026-93680

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the NFSD component. A local administrator with CAP SYS ADMIN privileges can crash the kernel by triggering a state-revocation walk before the server...

CVE-2026-92247: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

PT-2026-93707

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description An authorization failure exists in the 'GET /admin-api/system/user/page' endpoint because the @PreAuthorize annotation is commented out. This allows authenticated back-office users who lack the...