PT-2026-49214

WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete backup file and download backup file parameters in tools.php. Attackers can exploit insufficient input validation...

PT-2026-49216

WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to pic.php to access sensitive files like...

CVE-2026-50881

Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to escalate privileges to Administrator and execute unauthorized account, password, and configuration changes...

CVE-2026-50870

An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitive information via a crafted GET request...

CVE-2026-36521

PublicCMS V5.202506.d has a Cross Site Scripting XSS vulnerability in the site configuration management module...

CVE-2026-36521

PublicCMS version V5.202506.d is affected by a Cross Site Scripting (XSS) vulnerability located within the site configuration management module . This flaw allows an attacker to inject malicious scripts into web pages viewed by other users. No specific patch or newer version containing a fix is c...

CVE-2026-39006

A remote attacker can execute arbitrary code in SNMP4J-Agent version 3.8.3 by exploiting the snmp4jCfgStoragePath component. This vulnerability allows for remote code execution without user interaction. Currently, there is no information regarding a newer version that contains a fix for this issu...

PT-2026-49286

Name of the Vulnerable Software and Affected Versions PublicCMS version 5.202506.d Description A Cross Site Scripting XSS issue exists within the site configuration management module. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users...

CVE-2026-50870

An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitive information via a crafted GET request...

CVE-2026-36521

PublicCMS V5.202506.d has a Cross Site Scripting XSS vulnerability in the site configuration management module...

CVE-2026-49954: Improper Control of Filename for Include/Require Statement in PHP Program

Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigg...

CVE-2026-36521

PublicCMS V5.202506.d has a Cross Site Scripting XSS vulnerability in the site configuration management module...

PT-2026-49309

Discuz! X5.0 releases 20260320 through 20260501 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigg...

PT-2026-49311

Name of the Vulnerable Software and Affected Versions whoogle-search version 1.2.3 Description An information disclosure issue in the configuration endpoint allows attackers to obtain sensitive information by sending a crafted GET request. Recommendations At the moment, there is no information...

CVE-2026-44188

A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth Open Authorization access token before a user logs out, they...

CVE-2026-36521: Improper Neutralization of Input During Web Page Generation

PublicCMS V5.202506.d has a Cross Site Scripting XSS vulnerability in the site configuration management module...

CVE-2026-50870

An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitive information via a crafted GET request...

RuBackup Access Control Unauthorized Access Disclosure

The vulnerability of the RuBackup backup system is related to access control errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to confidential information in the “Global Configuration” panel...

PT-2026-49186

The Form Builder CP WordPress plugin before 1.2.47 does not properly sanitize a form configuration value before storing it and using it as part of a client-side script execution, allowing authenticated users with Editor-level access and above to perform Stored Cross-Site Scripting attacks against...

CVE-2026-50881

The impworks Bonsai v6.0 software is vulnerable to an incorrect access control flaw. This vulnerability allows authenticated attackers with Editor privileges to perform a privilege escalation to Administrator status. Once escalated, an attacker can execute unauthorized changes to accounts, passwo...