CVE-2026-92245

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

EUVD-2026-90464

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

PT-2026-104019

Name of the Vulnerable Software and Affected Versions PictShare versions prior to 3.7.1 Description An information disclosure issue exists where unauthenticated attackers can obtain the secret delete code and uploader metadata. This occurs when calling the 'API::info' endpoint, which returns the...

PT-2026-105181

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is authorized/2 delegates to rabbit mgmt util:is authorized monitor/2, which accepts the monitoring tag. But allowed methods includes DELETE, and delete...

CVE-2026-101148: External Control of File Name or Path

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

PT-2026-103786

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute D...

PT-2026-103781

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

CVE-2026-103253: Improper Neutralization of Special Elements used in an SQL Command

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute D...

PT-2026-103975

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role site admin or higher read and delete arbitrary files on a...

CVE-2026-88999: Missing Authorization

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

PT-2026-103692

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.15 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher...

PT-2026-105154

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is authorized/2 uses is authorized monitor for all methods. DELETE resets rabbit core metrics:reset auth attempt metrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbit mgmt w...

PT-2026-105126

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...

PT-2026-103666

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.33 Description An issue exists that allows unauthenticated attackers to extract customer personally identifiable information PII, such as names, email addresses, phone numbers, and custom...

CVE-2026-55231: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

CVE-2026-101889: Improper Limitation of a Pathname to a Restricted Directory

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tarrootfolder values in wprime-config.json. Attackers can exploit...

CVE-2026-34190: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-92245: Missing Authorization

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

PT-2026-105163

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

PT-2026-105804

Impact The live WebSocket transport authorizes a mount via check view auth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method decoratorlogin required, name="dispatch", and custom dispatch guards...