CVE-2026-90494

A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any w...

Exploit for CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA WordPre...

CVE-2026-81648: Missing Authorization

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...

CVE-2026-85129: Improper Neutralization of Input During Web Page Generation

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

PT-2026-90784

Name of the Vulnerable Software and Affected Versions restify node-restify versions prior to 12.0.1 Description A remote path traversal flaw exists in the serveStatic function within the /lib/plugins/static.js library. Path traversal is a technique that allows an attacker to access files and...

PT-2026-90963

Name of the Vulnerable Software and Affected Versions Hoo Companion WordPress plugin version 1.0.2 Description An import feature lacks authorization and validation checks and fails to sanitize submitted data before storing it as the active theme settings. This allows unauthenticated attackers to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: strongswan (UTSA-2022-000878)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000878 advisory. strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity and intermediate CA certificate...

PT-2026-90798

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...

PT-2026-90790

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

PT-2026-90791

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

PT-2026-90795

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...

PT-2026-90796

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

PT-2026-90797

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information...

PT-2026-90965

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

PT-2026-90966

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...

PT-2026-90962

Name of the Vulnerable Software and Affected Versions CryptoPayment Gateway versions 1.2.1 through 1.2.2 Description The plugin fails to apply an authorization check on an AJAX endpoint. This allows unauthenticated users to perform administrative operations, such as deleting arbitrary files on th...

CVE-2026-88995: Exposure of Sensitive Information to an Unauthorized Actor

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information...

PT-2026-90964

Name of the Vulnerable Software and Affected Versions YouTube Embed versions 10.0 through 10.3 Description The plugin fails to perform authorization checks on an AJAX action, relying solely on a nonce printed on front-end pages. Additionally, it does not escape stored data before rendering, which...

PT-2026-90793

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...

CVE-2026-90547

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID...