PT-2026-87031

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

PT-2026-88222

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A missing permission check in multiple functions of RangingServiceImpl.java allows for a Man-in-the-Middle MITM attack. This issue can result in remote informati...

PT-2026-88266

In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-3174: Missing Authorization

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

CVE-2026-28611: Missing Authorization

In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49883: Improper Privilege Management

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28659: Improper Privilege Management

In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28623: Missing Authorization

In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28582: Missing Authorization

In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed...

CVE-2026-0054: Missing Authorization

In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-72929: Improper Validation of Integrity Check Value

Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-2520: Missing Authorization

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

CVE-2026-9331: Missing Authorization

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

PT-2026-87023

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf delete feed function in all versions up to, and including, 1.0.2. This makes it possible for...

PT-2026-88295

Name of the Vulnerable Software and Affected Versions MicroXR Blobstore affected versions not specified Description A missing permission check in MicroXR Blobstore allows unauthorized access to files belonging to other applications. This flaw enables local escalation of privilege without requirin...

PT-2026-88208

In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-88238

In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-88248

In get eht operation channel width of ieee802 11 common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote proximal/adjacent information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-88170

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...

PT-2026-87190

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...