PT-2026-44753

Name of the Vulnerable Software and Affected Versions Service Center affected versions not specified Description An Insecure Direct Object Reference IDOR issue exists in Service Center, where an authenticated remote attacker can modify a parameter within a specific query function to access EC ord...

WordPress Theme Automotive Car Dealership Business 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-44853

Name of the Vulnerable Software and Affected Versions Indian Motorcycle Scout Bobber + Tech version 2025 Description Improper handling of physical conditions in the bike-shutdown control allows a physical attacker with access to the Wireless Control Module WCM wiring harness to bypass the...

shopper 安全漏洞

Shopper is an open-source e-commerce management backend developed by Shopper Labs. Versions of Shopper prior to 2.8.0 contained security vulnerabilities. These vulnerabilities stemmed from the fact that multiple Filament operations listed in administrator order details and order shipping tables...

Linux Distros Unpatched Vulnerability : CVE-2026-9967

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2024-13745

several issues with partition table measurements...

PT-2026-44750

Name of the Vulnerable Software and Affected Versions Automotive Car Dealership Business WordPress Theme versions prior to 13.4.2 Description The software is subject to Stored Cross-Site Scripting, a condition where malicious scripts are permanently stored on the target server. The issue exists i...

CVE-2025-14042: Improper Neutralization of Input During Web Page Generation

The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Project Details' custom field in Portfolio Items in all versions up to, and including, 13.4.1. This is due to insufficient input sanitization and output escaping on...

CVE-2026-9493: Authorization Bypass Through User-Controlled Key

Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify the parameter of a specific query function to access other users' EC order details...

CVE-2026-46842

...

CVE-2026-34311

CVE-2026-34311 concerns Oracle Hospitality OPERA 5 Property Services (Opera component). Affected versions are 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6, and 5.6.28. The vulnerability is exploitable over HTTP with network access and unauthenticated, leading to takeover of Oracle Hospitality OPERA 5 P...

CVE-2026-42459

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm Subscriber Data Management service. An unauthenticated attacker can inject control characters into the SUPI...

Exploit for CVE-2026-8832

EXPLOIT...

dovecot security update

An update is available for dovecot. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Dovecot is an IMAP server for Linux and other UNIX-like systems, written...

CGA-2JHG-RJCH-PWFG

Bulletin has no description...

CVE-2026-47715

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL. This is a project-boundary authorization issue: a...

CGA-84VX-9R95-5WPJ

Bulletin has no description...

portswigger-sqli-labs

PortSwigger Web Security Academy — SQL Injection Labs All 18...

CGA-7294-QHXF-W84H

Bulletin has no description...

Malicious code in @mlspace/connectors (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...