WordPress Bit Form plugin <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'filterText' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Bit Form versions = 3.2.0...

WordPress PPWP - Password Protect Pages plugin <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

WordPress PPWP - Password Protect Pages plugin = 1.9.21 - Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin PPWP versions = 1.9.21...

CVE-2026-16810

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-58588

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

EUVD-2026-58542

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...

EUVD-2026-58501

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

EUVD-2026-58549

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...

PT-2026-72055

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in...

PT-2026-72056

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered...

PT-2026-72040

In Akaunting versions sync call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by...

PT-2026-72117

Name of the Vulnerable Software and Affected Versions iCagenda versions prior to 2.0.0-4.0.11 Description Authenticated backend operators with permissions to access the extension can perform SQL injection. This occurs due to an unescaped numeric filter, allowing the injection of malicious SQL...

PT-2026-72105

Name of the Vulnerable Software and Affected Versions IBM Db2 Mirror for i versions 7.4 through 7.6 Description Remote authenticated attackers can bypass security restrictions due to improper neutralization of special elements used in an SQL command, which may lead to SQL injection. SQL injection...

Security Updates for Microsoft Dynamics 365 Business Central (August 2026)

The Microsoft Dynamics 365 Business Central install is missing a security update. It is, therefore, affected by an information disclosure vulnerability due to missing authorization. An authenticated, remote attacker can exploit this, to disclose potentially sensitive information. Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-73416

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6....

SAP NetWeaver AS Java Vulnerable Third-Party Component (3758318)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by the use of a vulnerable third-party component as referenced in SAP Security Note 3758318: - SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data...

PT-2026-72118

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 2.14.1 Description An issue in the FFmpeg integration allows authenticated users with assets/upload permissions to execute arbitrary commands. This occurs when a video file is uploaded with a filename containing...

Linux Distros Unpatched Vulnerability : CVE-2026-73627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow ...

SAP NetWeaver AS ABAP XSS (3721424)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3721424: - Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a...

PT-2026-72079

Name of the Vulnerable Software and Affected Versions Security Center affected versions not specified Description An authenticated command injection issue exists during file upload processing. An attacker with valid credentials can upload a specially crafted file to execute arbitrary commands on...