PT-2026-63850

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

PT-2026-64200

Name of the Vulnerable Software and Affected Versions Heimdall Data Database Proxy affected versions not specified Description Remote authenticated attackers can execute arbitrary code with root privileges on affected installations. The issue stems from the lack of proper neutralization of CRLF...

CVE-2026-61947: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...

PT-2026-63864

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

PT-2026-63608

Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions...

PT-2026-63849

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

CVE-2026-27423: Missing Authorization

Subscriber Broken Access Control in Participants Database = 2.7.8.4 versions...

CVE-2026-64876: Cross-Site Request Forgery (CSRF)

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates...

CVE-2026-59555: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.3 versions...

CVE-2026-15448: Improper Neutralization of Special Elements used in an SQL Command

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-15761: Improper Neutralization of Special Elements used in an SQL Command

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

Alibaba Cloud Linux 3 : 0218: perl-DBI:1.641 (ALINUX3-SA-2026:0218)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0218 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-10879: DBI versions before 1.648...

PT-2026-63874

Contributor SQL Injection in MapSVG = 8.14.0 versions...

PT-2026-63819

Subscriber Broken Access Control in Participants Database = 2.7.8.4 versions...

CVE-2026-59525: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

CVE-2026-60081 affecting package perl-DBI for versions less than 1.651-1

CVE-2026-60081 affecting package perl-DBI for versions less than 1.651-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1

CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-15043 affecting package perl-DBI for versions less than 1.651-1

CVE-2026-15043 affecting package perl-DBI for versions less than 1.651-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-63685

Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially...

CVE-2026-63685 Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension

Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially...