PT-2026-21153

Name of the Vulnerable Software and Affected Versions AncoraThemes SevenHills versions through 1.6.2 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. Recommendations Update AncoraThemes SevenHills to a version newer than 1.6.2...

PT-2026-21071

Name of the Vulnerable Software and Affected Versions Plugin BlueX for WooCommerce versions through 3.1.6 Description An issue exists in Plugin BlueX for WooCommerce related to incorrectly configured access control security levels, potentially allowing unauthorized access. The issue involves a...

PT-2026-21147

Name of the Vulnerable Software and Affected Versions TeconceTheme Uroan Core versions through 1.4.4 Description A flaw exists in TeconceTheme Uroan Core that allows for Blind SQL Injection. This is due to improper neutralization of special elements used in an SQL command. Recommendations Update...

PT-2026-21167

Name of the Vulnerable Software and Affected Versions RVCFDI para Woocommerce versions through 8.1.8 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Reflected Cross-Site Scripting XSS condition. This could all...

PT-2026-21124

Name of the Vulnerable Software and Affected Versions GhostPool Aardvark versions through 4.6.3 Description A Reflected Cross-site Scripting XSS issue exists in GhostPool Aardvark. This allows for improper neutralization of input during web page generation. The issue could potentially allow an...

WordPress plugin Print Invoice & Delivery Notes for WooCommerce 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

Aruba ClearPass Policy Manager 6.11.x < 6.11.13 / 6.12.x < 6.12.7 Local Privilege Escalation (CVE-2026-23599)

The version of Aruba ClearPass Policy Manager installed on the remote host is prior to 6.11.13 or 6.12.7. It is, therefore, affected by a local privilege escalation vulnerability as referenced in the HPESBNW05012 advisory. - A local privilege-escalation vulnerability has been discovered in the HP...

PT-2026-21226

Name of the Vulnerable Software and Affected Versions Applay - Shortcodes versions through 3.7 Description A flaw exists in the Applay - Shortcodes application that allows for object injection due to deserialization of untrusted data. This issue impacts the application's functionality related to...

PT-2026-21126

Name of the Vulnerable Software and Affected Versions GhostPool Gauge versions through 6.56.4 Description A missing authorization flaw exists in the GhostPool Gauge gauge, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update GhostPool Gauge to...

Atlassian Confluence 8.5.x < 9.2.1 / 9.3.x < 9.4.0 / 9.5.x < 9.5.1 / 10.0.x < 10.2.3 / 10.2.6 (CONFSERVER-102185)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-102185 advisory. - Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrust...

PT-2026-21128

Name of the Vulnerable Software and Affected Versions PhotoMe versions n/a through 5.6.11 Description A flaw exists in PhotoMe that allows for object injection due to deserialization of untrusted data. This issue impacts the application's ability to securely handle incoming data, potentially...

PT-2026-21031

Name of the Vulnerable Software and Affected Versions Seraphinite Solutions Seraphinite Accelerator versions through 2.22.15 Description A missing authorization issue exists in Seraphinite Accelerator, potentially allowing retrieval of embedded sensitive data. The issue affects the...

CVE-2026-26963

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6...

CVE-2026-1658

OpenText Directory Services (20.4.1–25.2) contains CVE-2026-1658: a UI misrepresentation of critical information can enable cache poisoning, potentially misleading users. Affected components are within OpenText Directory Services could present manipulated text, with impact described as low integr...

GHSA-6C9J-X93C-RW6J OpenClaw safeBins file-existence oracle information disclosure

An information disclosure vulnerability in OpenClaw's tools.exec.safeBins approval flow allowed a file-existence oracle. When safe-bin validation examined candidate file paths, command allow/deny behavior could differ based on whether a path already existed on the host filesystem. An attacker cou...

CVE-2026-27360

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through = 1.8.38...

CVE-2026-27114

NanaZip has an infinite-loop vulnerability in its ROMFS archive parser caused by circular NextOffset chains in versions 5.0.1252.0 through before 6.0.1630.0. Version 6.0.1630.0 patches the issue. Affected component: ROMFS archive parsing within NanaZip. Impact (as stated): availability is HIGH, w...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by unknown CVE via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: unknown CVE Source advisory: SNYK:JS-SVELTEJSKIT-15322998...

@budibase/server (>=3.32.1, <=3.38.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.6.6, <=2.1.0) +52 more potentially affected by CVE-2026-27125 via svelte (>=5.0.0, <=5.51.2)

svelte NPM version =5.0.0, =3.32.1, =0.6.6, =4.0.0-alpha.1, =4.0.0-alpha.1, =0.1.0, =0.0.1, =1.3.0, =0.1.4, =0.0.20, =0.15.0-beta.2, =1.1.0-beta.0, =5.0.0-next.80, =0.1.1-alpha.24, =0.1.3-next.2 and more Source cves: CVE-2026-27125 Source advisory: SNYK:JS-SVELTE-15322714...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25940 via jspdf (>=4.0.0, <=4.1.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25940 Source advisory: SNYK:JS-JSPDF-15322684...