268377 matches found
PT-2026-100547
Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101075
Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101299
Security vulnerability affects the nvidia-device-plugin package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-100417
Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-95267
Name of the Vulnerable Software and Affected Versions InfiniteWP Client plugin for WordPress versions prior to 1.14.0 Description An issue exists in the get comments action where insufficient escaping of array-key names in the JSON request body allows for SQL Injection. The IWP MMB Comment::get...
PT-2026-95261
Name of the Vulnerable Software and Affected Versions All Bootstrap Blocks WordPress plugin versions prior to 1.3.32 Description The plugin fails to validate a block attribute used to construct a filesystem path during rendering. This allows users with contributor-level access or higher to perfor...
PT-2026-95241
Name of the Vulnerable Software and Affected Versions UpsellWP versions prior to 2.2.10 Description The UpsellWP WordPress plugin fails to verify if products added to the cart via a Frequently Bought Together campaign are actually part of that specific campaign. This allows unauthenticated users ...
PT-2026-95251
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if the requesting user owns a course before returning its enrolled-student data. This allows...
PT-2026-95258
Name of the Vulnerable Software and Affected Versions Breeze Cache WordPress plugin versions prior to 2.5.15 Description The plugin fails to include specific tracking-related query parameters in its page-cache key while continuing to cache pages requested with those parameters. This allows an...
PT-2026-95293
Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.3.1 Description An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs because the additional params...
PT-2026-95283
Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.4 Description An Insecure Direct Object Reference IDOR exists in the LatePointAbilityDeleteBooking::execute function due to missing validation on a...
PT-2026-95240
Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.8.15 Description Unauthenticated visitors can attach unrestricted file types to the live chat feature. Because the plugin fails to sanitize the contents of these...
PT-2026-101925
Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-95597
Name of the Vulnerable Software and Affected Versions Weaver E-cology affected versions not specified Description An unauthenticated SQL injection allows remote attackers to execute arbitrary SQL queries. This occurs when malicious input is submitted through the userIdentifiers GET parameter in t...
PT-2026-95701
Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 1.0.1 Description The ratings plugin AJAX handler fails to validate anti-CSRF tokens, which are unique tokens used to prevent Cross-Site Request Forgery CSRF—an attack that forces an authenticated user to execute...
PT-2026-95676
Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An OS command injection flaw exists in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a...
CVE-2026-18441: Authorization Bypass Through User-Controlled Key
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...
WP < 7.1.1 - Admin+ Network-Wide Plugin Activation on Multisite
Description WordPress does not properly restrict plugin activation on Multisite in some cases, which could allow site administrators to activate an installed plugin network-wide...
PT-2026-95231
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient per-object ownership or capability checks occur when updating orders via the REST API. This allows users with the Instructor role to modify any order on the sit...